traffic.tsb.tetrate.io/v2

Resource Types:

• Group

• ServiceRoute

• ServiceTrafficSetting

• TrafficSetting

Group

↩ Parent

Name	Type	Description	Required
apiVersion	string	traffic.tsb.tetrate.io/v2	true
kind	string	Group	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	A traffic group manages the routing properties of proxy workloads in a group of namespaces owned by the parent workspace.	false
status	object		false

Group.spec

↩ Parent

A traffic group manages the routing properties of proxy workloads in a group of namespaces owned by the parent workspace.

Name	Type	Description	Required
namespaceSelector	object	Set of namespaces owned exclusively by this group.	true
configGenerationMetadata	object	Default metadata values that will be propagated to the children Istio generated configurations.	false
configMode	enum	The Configuration types that will be added to this group. Enum: BRIDGED, DIRECT	false
deletionProtectionEnabled	boolean	When set, prevents the resource from being deleted.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
profiles	[]string	List of profiles attached to the traffic group to be used to propagate default and mandatory configurations down to the children.	false

Group.spec.namespaceSelector

↩ Parent

Set of namespaces owned exclusively by this group.

Name	Type	Description	Required
names	[]string	Under the tenant/workspace/group: - */ns1 implies ns1 namespace in any cluster.	true

Group.spec.configGenerationMetadata

↩ Parent

Default metadata values that will be propagated to the children Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

ServiceRoute

↩ Parent

Name	Type	Description	Required
apiVersion	string	traffic.tsb.tetrate.io/v2	true
kind	string	ServiceRoute	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	A service route controls routing configurations for traffic to a service in a traffic group.	false
status	object		false

ServiceRoute.spec

↩ Parent

A service route controls routing configurations for traffic to a service in a traffic group.

Name	Type	Description	Required
service	string	The service on which the configuration is being applied.	true
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
httpRoutes	[]object	HTTPRoutes are used when HTTP traffic needs to be matched on uri, headers and port and destination routes need to be set using subset-weight combinations specified within the route.	false
portLevelSettings	[]object	In order to support multi-protocol routing, a list of all port/protocol combinations is needed.	false
stickySession	object		false
subsets	[]object	The set of versions of a service and the percentage of traffic to send to each version.	false
tcpRoutes	[]object	TCPRoutes match TCP traffic based on port number.	false

ServiceRoute.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

ServiceRoute.spec.httpRoutes[index]

↩ Parent

Name	Type	Description	Required
name	string	Name of the route.	true
destination	[]object	Destination host:port and subset where HTTP traffic should be directed.	false
fault	object	Fault injection policy to apply on HTTP traffic at the client side.	false
flagger	object	FlaggerDestination will route traffic based on a Flagger Canary resource.	false
match	[]object		false
mirrors	[]object	Mirror HTTP traffic to multiple destinations in addition to forwarding the requests to the intended destination.	false

ServiceRoute.spec.httpRoutes[index].destination[index]

↩ Parent

Name	Type	Description	Required
port	integer		true
destinationHost	string	Service host where traffic should be routed to.	false
subset	string		false
weight	integer		false

ServiceRoute.spec.httpRoutes[index].fault

↩ Parent

Fault injection policy to apply on HTTP traffic at the client side.

Name	Type	Description	Required
abort	object	Abort HTTP request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty.	false
delay	object	Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc.	false

ServiceRoute.spec.httpRoutes[index].fault.abort

↩ Parent

Abort HTTP request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty.

Name	Type	Description	Required
grpcStatus	string	GRPC status code to use to abort the request.	false
httpStatus	integer	HTTP status code to use to abort the HTTP request. Format: int32	false
percentage	number	Percentage of requests to be aborted with the error code provided. Format: double	false

ServiceRoute.spec.httpRoutes[index].fault.delay

↩ Parent

Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc.

Name	Type	Description	Required
fixedDelay	string	Add a fixed delay before forwarding the request.	false
percentage	number	Percentage of requests on which the delay will be injected. Format: double	false

ServiceRoute.spec.httpRoutes[index].flagger

↩ Parent

FlaggerDestination will route traffic based on a Flagger Canary resource.

Name	Type	Description	Required
canary	string	Name of the Canary resource that will manage the deployment.	true
namespace	string	Namespace of the Canary resource that will manage the deployment.	true

ServiceRoute.spec.httpRoutes[index].match[index]

↩ Parent

Name	Type	Description	Required
name	string		true
headers	map[string]object		false
port	integer		false
uri	object		false

ServiceRoute.spec.httpRoutes[index].match[index].headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

ServiceRoute.spec.httpRoutes[index].match[index].uri

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

ServiceRoute.spec.httpRoutes[index].mirrors[index]

↩ Parent

Name	Type	Description	Required
port	integer		true
host	string	The host where traffic should be routed to.	false
percentage	number	Percentage of the traffic to be mirrored. Format: double	false
subset	string		false

ServiceRoute.spec.portLevelSettings[index]

↩ Parent

Name	Type	Description	Required
port	integer		true
trafficType	enum	Enum: HTTP, TCP, TLS_PASSTHROUGH	true
stickySession	object	Since we are supporting multiple types of protocols, so we expect to have separate sticky sessions for each route (i.e.	false

ServiceRoute.spec.portLevelSettings[index].stickySession

↩ Parent

Since we are supporting multiple types of protocols, so we expect to have separate sticky sessions for each route (i.e.

Name	Type	Description	Required
cookie	object	Hash based on HTTP cookie.	false
header	string	Hash based on a specific HTTP header.	false
useSourceIp	boolean	Hash based on the source IP address.	false

ServiceRoute.spec.portLevelSettings[index].stickySession.cookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
path	string	Path to set for the cookie.	true
ttl	string	Lifetime of the cookie.	true

ServiceRoute.spec.stickySession

↩ Parent

Name	Type	Description	Required
cookie	object	Hash based on HTTP cookie.	false
header	string	Hash based on a specific HTTP header.	false
useSourceIp	boolean	Hash based on the source IP address.	false

ServiceRoute.spec.stickySession.cookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
path	string	Path to set for the cookie.	true
ttl	string	Lifetime of the cookie.	true

ServiceRoute.spec.subsets[index]

↩ Parent

Name	Type	Description	Required
name	string	Name used to refer to the subset.	true
labels	map[string]string	Labels apply a filter over the endpoints of a service in the service registry.	false
portLevelSettings	[]object	Port/Protocol/StickySession combination for which routes need to be generated specifically for a subset.	false
weight	integer	Percentage of traffic to be sent to this subset.	false

ServiceRoute.spec.subsets[index].portLevelSettings[index]

↩ Parent

Name	Type	Description	Required
port	integer		true
trafficType	enum	Enum: HTTP, TCP, TLS_PASSTHROUGH	true
stickySession	object	Since we are supporting multiple types of protocols, so we expect to have separate sticky sessions for each route (i.e.	false

ServiceRoute.spec.subsets[index].portLevelSettings[index].stickySession

↩ Parent

Since we are supporting multiple types of protocols, so we expect to have separate sticky sessions for each route (i.e.

Name	Type	Description	Required
cookie	object	Hash based on HTTP cookie.	false
header	string	Hash based on a specific HTTP header.	false
useSourceIp	boolean	Hash based on the source IP address.	false

ServiceRoute.spec.subsets[index].portLevelSettings[index].stickySession.cookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
path	string	Path to set for the cookie.	true
ttl	string	Lifetime of the cookie.	true

ServiceRoute.spec.tcpRoutes[index]

↩ Parent

Name	Type	Description	Required
name	string		true
destination	[]object		false
match	[]object		false

ServiceRoute.spec.tcpRoutes[index].destination[index]

↩ Parent

Name	Type	Description	Required
port	integer		true
destinationHost	string	Service host where traffic should be routed to.	false
subset	string		false
weight	integer		false

ServiceRoute.spec.tcpRoutes[index].match[index]

↩ Parent

Name	Type	Description	Required
name	string		true
port	integer		true

ServiceTrafficSetting

↩ Parent

Name	Type	Description	Required
apiVersion	string	traffic.tsb.tetrate.io/v2	true
kind	string	ServiceTrafficSetting	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	A service traffic setting applies configuration to a service in a traffic group.	false
status	object		false

ServiceTrafficSetting.spec

↩ Parent

A service traffic setting applies configuration to a service in a traffic group.

Name	Type	Description	Required
service	string	The service on which the configuration is being applied.	true
settings	object	Traffic settings to apply to this service.	true
configGenerationMetadata	object	Metadata values that will be add into the mesh-generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false

ServiceTrafficSetting.spec.settings

↩ Parent

Traffic settings to apply to this service.

Name	Type	Description	Required
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
egress	object	Specifies the details of the egress proxy to which unknown traffic should be forwarded to from the proxy workload.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
inbound	object	Configures inbound traffic.	false
outbound	object	Configures outbound traffic.	false
rateLimiting	object	Configuration for rate limiting requests.	false
reachability	object	The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.	false
resilience	object	Resilience settings such as timeouts, retries, etc., affecting outbound traffic from proxy workloads.	false
upstreamTrafficSettings	[]object	List of hosts and the associated traffic settings to be used by the clients that are downstreams to the defined upstream hosts.	false

ServiceTrafficSetting.spec.settings.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

ServiceTrafficSetting.spec.settings.egress

↩ Parent

Specifies the details of the egress proxy to which unknown traffic should be forwarded to from the proxy workload.

Name	Type	Description	Required
host	string	Specifies the egress gateway hostname.	true
port	integer	Deprecated. Format: int32	false

ServiceTrafficSetting.spec.settings.inbound

↩ Parent

Configures inbound traffic.

Name	Type	Description	Required
failoverSettings	object	Failover settings apply to all clients accessing the hostname defined in this section.	false
rateLimiting	object	Configuration for rate limiting requests.	false
resilience	object	Resiliency configuration for inbound connections.	false

ServiceTrafficSetting.spec.settings.inbound.failoverSettings

↩ Parent

Failover settings apply to all clients accessing the hostname defined in this section.

Name	Type	Description	Required
failoverPriority	[]string	FailoverPriority specifies the failover priority for traffic.	false
regionalFailover	[]object	Locality routing settings for all gateways in the Workspace/Organization for which this is defined.	false
topologyChoice	enum	TopologyChoice specifies the topology preference for traffic priority. Enum: NONE, CLUSTER, LOCALITY	false

ServiceTrafficSetting.spec.settings.inbound.failoverSettings.regionalFailover[index]

↩ Parent

Name	Type	Description	Required
from	string	Originating region.	false
to	string	Destination region the traffic will fail over to when endpoints in the 'from' region become unhealthy.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	true
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	true
rules	[]object	A set of rate limit rules.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object	Configure TLS parameters to be used when connecting to the external rate limit server.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	true

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	true
headers	map[string]object	Specifies a set of headers that the rate limit action should match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	true
headerName	string	The header name to be queried from the request headers.	true

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.tls

↩ Parent

Configure TLS parameters to be used when connecting to the external rate limit server.

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string	File containing CA certificates to verify the certificates presented by the server.	false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings

↩ Parent

Name	Type	Description	Required
rules	[]object	A list of rules for ratelimiting.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	true
limit	object	The ratelimit value that will be configured for the above rules.	true

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
name	string	Name of the header to match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
value	object	Value of the header to match on if matching on a specific value.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	true

ServiceTrafficSetting.spec.settings.inbound.rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit.	true
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	true

ServiceTrafficSetting.spec.settings.inbound.resilience

↩ Parent

Resiliency configuration for inbound connections.

Name	Type	Description	Required
connectionPool	object	Configures tolerance and other settings for TCP/HTTP connections to the service.	false

ServiceTrafficSetting.spec.settings.inbound.resilience.connectionPool

↩ Parent

Configures tolerance and other settings for TCP/HTTP connections to the service.

Name	Type	Description	Required
tcp	object		false

ServiceTrafficSetting.spec.settings.inbound.resilience.connectionPool.tcp

↩ Parent

Name	Type	Description	Required
keepAlive	object	Keep Alive Settings.	false

ServiceTrafficSetting.spec.settings.inbound.resilience.connectionPool.tcp.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

ServiceTrafficSetting.spec.settings.outbound

↩ Parent

Configures outbound traffic.

Name	Type	Description	Required
egress	object	Specifies the details of the egress proxy to which traffic to services that are not part to the mesh should be forwarded to from the proxy workloads.	false
reachability	object	The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.	false
upstreamTrafficSettings	[]object	List of hosts and the associated traffic settings to be used by the clients sending traffic to them.	false

ServiceTrafficSetting.spec.settings.outbound.egress

↩ Parent

Specifies the details of the egress proxy to which traffic to services that are not part to the mesh should be forwarded to from the proxy workloads.

Name	Type	Description	Required
host	string	Specifies the egress gateway hostname.	true

ServiceTrafficSetting.spec.settings.outbound.reachability

↩ Parent

The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.

Name	Type	Description	Required
hosts	[]string	When the mode is CUSTOM, hosts specify the set of services that the sidecar should be able to reach.	false
mode	enum	A short cut for specifying the set of services accessed by the workload. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, CUSTOM	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index]

↩ Parent

Name	Type	Description	Required
hosts	[]string	List of hosts for which the settings will be created.	false
settings	object	A single setting to be applied to all the clients connecting to the upstream hosts.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings

↩ Parent

A single setting to be applied to all the clients connecting to the upstream hosts.

Name	Type	Description	Required
authentication	object	Configuration for connection authentication parameters.	false
loadBalancer	object	Load balancing settings for the clients.	false
resilience	object	Resilience settings for the clients.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.authentication

↩ Parent

Configuration for connection authentication parameters.

Name	Type	Description	Required
trafficMode	enum	If set to REQUIRED, client sidecars under this configuration will be configured to initiate mTLS connections using mesh-generated client certificates to services that do not have a sidecar injected. Enum: UNSET, OPTIONAL, REQUIRED	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.loadBalancer

↩ Parent

Load balancing settings for the clients.

Name	Type	Description	Required
consistentHash	object	Use consistent hash load balancing which can provide soft session affinity.	false
simple	enum	Use standard load balancing algorithms that require no tuning. Enum: UNSPECIFIED, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash

↩ Parent

Use consistent hash load balancing which can provide soft session affinity.

Name	Type	Description	Required
httpCookie	object	Hash based on HTTP cookie.	false
httpHeaderName	string	Hash based on a specific HTTP header.	false
httpQueryParameterName	string	Hash based on a specific HTTP query parameter.	false
maglev	object	The Maglev load balancer implements consistent hashing to backend hosts.	false
ringHash	object	The ring/modulo hash load balancer implements consistent hashing to backend hosts.	false
useSourceIp	boolean	Hash based on the source IP address.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.httpCookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
ttl	string	Lifetime of the cookie.	true
path	string	Path to set for the cookie.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.maglev

↩ Parent

The Maglev load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
tableSize	integer	The table size for Maglev hashing.	true

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.ringHash

↩ Parent

The ring/modulo hash load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
minimumRingSize	integer	The minimum number of virtual nodes to use for the hash ring.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.resilience

↩ Parent

Resilience settings for the clients.

Name	Type	Description	Required
circuitBreakerSensitivity	enum	Circuit breakers in Envoy are applied per endpoint in a load balancing pool. Enum: UNSET, LOW, MEDIUM, HIGH	false
connectionPool	object	Configures tolerance and other settings for TCP/HTTP connections to the service.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool

↩ Parent

Configures tolerance and other settings for TCP/HTTP connections to the service.

Name	Type	Description	Required
http	object		false
tcp	object		false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.http

↩ Parent

Name	Type	Description	Required
maxRequests	integer	Maximum number of active requests to the service.	false
maxRequestsPerConnection	integer	Maximum number of requests per connection to the service.	false
requestTimeout	string	Timeout for HTTP requests.	false
retries	object	Retry policy for HTTP requests.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.http.retries

↩ Parent

Retry policy for HTTP requests.

Name	Type	Description	Required
attempts	integer	Number of retries for a given request. Format: int32	true
perTryTimeout	string	Timeout per retry attempt for a given request.	false
retryOn	string	Specifies the conditions under which retry takes place.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp

↩ Parent

Name	Type	Description	Required
connectTimeout	string	TCP connection timeout.	false
keepAlive	object	Keep Alive Settings.	false
maxConnections	integer	Maximum number of HTTP1 /TCP connections to the service.	false

ServiceTrafficSetting.spec.settings.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

ServiceTrafficSetting.spec.settings.rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

ServiceTrafficSetting.spec.settings.rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	true
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	true
rules	[]object	A set of rate limit rules.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object	Configure TLS parameters to be used when connecting to the external rate limit server.	false

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	true

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	true
headers	map[string]object	Specifies a set of headers that the rate limit action should match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	true
headerName	string	The header name to be queried from the request headers.	true

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.tls

↩ Parent

Configure TLS parameters to be used when connecting to the external rate limit server.

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

ServiceTrafficSetting.spec.settings.rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string	File containing CA certificates to verify the certificates presented by the server.	false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

ServiceTrafficSetting.spec.settings.rateLimiting.settings

↩ Parent

Name	Type	Description	Required
rules	[]object	A list of rules for ratelimiting.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

ServiceTrafficSetting.spec.settings.rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	true
limit	object	The ratelimit value that will be configured for the above rules.	true

ServiceTrafficSetting.spec.settings.rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

ServiceTrafficSetting.spec.settings.rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
name	string	Name of the header to match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
value	object	Value of the header to match on if matching on a specific value.	false

ServiceTrafficSetting.spec.settings.rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

ServiceTrafficSetting.spec.settings.rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	true

ServiceTrafficSetting.spec.settings.rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit.	true
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	true

ServiceTrafficSetting.spec.settings.reachability

↩ Parent

The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.

Name	Type	Description	Required
hosts	[]string	When the mode is CUSTOM, hosts specify the set of services that the sidecar should be able to reach.	false
mode	enum	A short cut for specifying the set of services accessed by the workload. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, CUSTOM	false

ServiceTrafficSetting.spec.settings.resilience

↩ Parent

Resilience settings such as timeouts, retries, etc., affecting outbound traffic from proxy workloads.

Name	Type	Description	Required
circuitBreakerSensitivity	enum	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.circuitBreakerSensitivity. Enum: UNSET, LOW, MEDIUM, HIGH	false
httpRequestTimeout	string	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.http.requestTimeout.	false
httpRetries	object	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.http.retries.	false
keepAlive	object	Keep Alive Settings.	false
tcpKeepalive	boolean	Deprecated.	false

ServiceTrafficSetting.spec.settings.resilience.httpRetries

↩ Parent

This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.http.retries.

Name	Type	Description	Required
attempts	integer	Number of retries for a given request. Format: int32	true
perTryTimeout	string	Timeout per retry attempt for a given request.	false
retryOn	string	Specifies the conditions under which retry takes place.	false

ServiceTrafficSetting.spec.settings.resilience.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
tcp	object	TCP Keep Alive settings associated with the upstream and downstream TCP connections.	false

ServiceTrafficSetting.spec.settings.resilience.keepAlive.tcp

↩ Parent

TCP Keep Alive settings associated with the upstream and downstream TCP connections.

Name	Type	Description	Required
downstream	object	TCP Keep Alive Settings associated with the downstream (client) connection.	false
upstream	object	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.tcp.keepAlive.	false

ServiceTrafficSetting.spec.settings.resilience.keepAlive.tcp.downstream

↩ Parent

TCP Keep Alive Settings associated with the downstream (client) connection.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

ServiceTrafficSetting.spec.settings.resilience.keepAlive.tcp.upstream

↩ Parent

This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.tcp.keepAlive.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index]

↩ Parent

Name	Type	Description	Required
hosts	[]string	List of hosts for which the settings will be created.	false
settings	object	A single setting to be applied to all the clients connecting to the upstream hosts.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings

↩ Parent

A single setting to be applied to all the clients connecting to the upstream hosts.

Name	Type	Description	Required
authentication	object	Configuration for connection authentication parameters.	false
loadBalancer	object	Load balancing settings for the clients.	false
resilience	object	Resilience settings for the clients.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.authentication

↩ Parent

Configuration for connection authentication parameters.

Name	Type	Description	Required
trafficMode	enum	If set to REQUIRED, client sidecars under this configuration will be configured to initiate mTLS connections using mesh-generated client certificates to services that do not have a sidecar injected. Enum: UNSET, OPTIONAL, REQUIRED	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.loadBalancer

↩ Parent

Load balancing settings for the clients.

Name	Type	Description	Required
consistentHash	object	Use consistent hash load balancing which can provide soft session affinity.	false
simple	enum	Use standard load balancing algorithms that require no tuning. Enum: UNSPECIFIED, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash

↩ Parent

Use consistent hash load balancing which can provide soft session affinity.

Name	Type	Description	Required
httpCookie	object	Hash based on HTTP cookie.	false
httpHeaderName	string	Hash based on a specific HTTP header.	false
httpQueryParameterName	string	Hash based on a specific HTTP query parameter.	false
maglev	object	The Maglev load balancer implements consistent hashing to backend hosts.	false
ringHash	object	The ring/modulo hash load balancer implements consistent hashing to backend hosts.	false
useSourceIp	boolean	Hash based on the source IP address.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.httpCookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
ttl	string	Lifetime of the cookie.	true
path	string	Path to set for the cookie.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.maglev

↩ Parent

The Maglev load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
tableSize	integer	The table size for Maglev hashing.	true

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.ringHash

↩ Parent

The ring/modulo hash load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
minimumRingSize	integer	The minimum number of virtual nodes to use for the hash ring.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.resilience

↩ Parent

Resilience settings for the clients.

Name	Type	Description	Required
circuitBreakerSensitivity	enum	Circuit breakers in Envoy are applied per endpoint in a load balancing pool. Enum: UNSET, LOW, MEDIUM, HIGH	false
connectionPool	object	Configures tolerance and other settings for TCP/HTTP connections to the service.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.resilience.connectionPool

↩ Parent

Configures tolerance and other settings for TCP/HTTP connections to the service.

Name	Type	Description	Required
http	object		false
tcp	object		false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.resilience.connectionPool.http

↩ Parent

Name	Type	Description	Required
maxRequests	integer	Maximum number of active requests to the service.	false
maxRequestsPerConnection	integer	Maximum number of requests per connection to the service.	false
requestTimeout	string	Timeout for HTTP requests.	false
retries	object	Retry policy for HTTP requests.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.resilience.connectionPool.http.retries

↩ Parent

Retry policy for HTTP requests.

Name	Type	Description	Required
attempts	integer	Number of retries for a given request. Format: int32	true
perTryTimeout	string	Timeout per retry attempt for a given request.	false
retryOn	string	Specifies the conditions under which retry takes place.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp

↩ Parent

Name	Type	Description	Required
connectTimeout	string	TCP connection timeout.	false
keepAlive	object	Keep Alive Settings.	false
maxConnections	integer	Maximum number of HTTP1 /TCP connections to the service.	false

ServiceTrafficSetting.spec.settings.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

ServiceTrafficSetting.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the mesh-generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

TrafficSetting

↩ Parent

Name	Type	Description	Required
apiVersion	string	traffic.tsb.tetrate.io/v2	true
kind	string	TrafficSetting	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	A traffic setting applies configuration to a set of proxy workloads in a traffic group or a workspace.	false
status	object		false

TrafficSetting.spec

↩ Parent

A traffic setting applies configuration to a set of proxy workloads in a traffic group or a workspace.

Name	Type	Description	Required
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
egress	object	Specifies the details of the egress proxy to which unknown traffic should be forwarded to from the proxy workload.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
inbound	object	Configures inbound traffic.	false
outbound	object	Configures outbound traffic.	false
rateLimiting	object	Configuration for rate limiting requests.	false
reachability	object	The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.	false
resilience	object	Resilience settings such as timeouts, retries, etc., affecting outbound traffic from proxy workloads.	false
upstreamTrafficSettings	[]object	List of hosts and the associated traffic settings to be used by the clients that are downstreams to the defined upstream hosts.	false

TrafficSetting.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

TrafficSetting.spec.egress

↩ Parent

Specifies the details of the egress proxy to which unknown traffic should be forwarded to from the proxy workload.

Name	Type	Description	Required
host	string	Specifies the egress gateway hostname.	true
port	integer	Deprecated. Format: int32	false

TrafficSetting.spec.inbound

↩ Parent

Configures inbound traffic.

Name	Type	Description	Required
failoverSettings	object	Failover settings apply to all clients accessing the hostname defined in this section.	false
rateLimiting	object	Configuration for rate limiting requests.	false
resilience	object	Resiliency configuration for inbound connections.	false

TrafficSetting.spec.inbound.failoverSettings

↩ Parent

Failover settings apply to all clients accessing the hostname defined in this section.

Name	Type	Description	Required
failoverPriority	[]string	FailoverPriority specifies the failover priority for traffic.	false
regionalFailover	[]object	Locality routing settings for all gateways in the Workspace/Organization for which this is defined.	false
topologyChoice	enum	TopologyChoice specifies the topology preference for traffic priority. Enum: NONE, CLUSTER, LOCALITY	false

TrafficSetting.spec.inbound.failoverSettings.regionalFailover[index]

↩ Parent

Name	Type	Description	Required
from	string	Originating region.	false
to	string	Destination region the traffic will fail over to when endpoints in the 'from' region become unhealthy.	false

TrafficSetting.spec.inbound.rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

TrafficSetting.spec.inbound.rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	true
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	true
rules	[]object	A set of rate limit rules.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object	Configure TLS parameters to be used when connecting to the external rate limit server.	false

TrafficSetting.spec.inbound.rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	true

TrafficSetting.spec.inbound.rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

TrafficSetting.spec.inbound.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	true
headers	map[string]object	Specifies a set of headers that the rate limit action should match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false

TrafficSetting.spec.inbound.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

TrafficSetting.spec.inbound.rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	true
headerName	string	The header name to be queried from the request headers.	true

TrafficSetting.spec.inbound.rateLimiting.externalService.tls

↩ Parent

Configure TLS parameters to be used when connecting to the external rate limit server.

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

TrafficSetting.spec.inbound.rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string	File containing CA certificates to verify the certificates presented by the server.	false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

TrafficSetting.spec.inbound.rateLimiting.settings

↩ Parent

Name	Type	Description	Required
rules	[]object	A list of rules for ratelimiting.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

TrafficSetting.spec.inbound.rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	true
limit	object	The ratelimit value that will be configured for the above rules.	true

TrafficSetting.spec.inbound.rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

TrafficSetting.spec.inbound.rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
name	string	Name of the header to match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
value	object	Value of the header to match on if matching on a specific value.	false

TrafficSetting.spec.inbound.rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

TrafficSetting.spec.inbound.rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	true

TrafficSetting.spec.inbound.rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit.	true
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	true

TrafficSetting.spec.inbound.resilience

↩ Parent

Resiliency configuration for inbound connections.

Name	Type	Description	Required
connectionPool	object	Configures tolerance and other settings for TCP/HTTP connections to the service.	false

TrafficSetting.spec.inbound.resilience.connectionPool

↩ Parent

Configures tolerance and other settings for TCP/HTTP connections to the service.

Name	Type	Description	Required
tcp	object		false

TrafficSetting.spec.inbound.resilience.connectionPool.tcp

↩ Parent

Name	Type	Description	Required
keepAlive	object	Keep Alive Settings.	false

TrafficSetting.spec.inbound.resilience.connectionPool.tcp.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

TrafficSetting.spec.outbound

↩ Parent

Configures outbound traffic.

Name	Type	Description	Required
egress	object	Specifies the details of the egress proxy to which traffic to services that are not part to the mesh should be forwarded to from the proxy workloads.	false
reachability	object	The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.	false
upstreamTrafficSettings	[]object	List of hosts and the associated traffic settings to be used by the clients sending traffic to them.	false

TrafficSetting.spec.outbound.egress

↩ Parent

Specifies the details of the egress proxy to which traffic to services that are not part to the mesh should be forwarded to from the proxy workloads.

Name	Type	Description	Required
host	string	Specifies the egress gateway hostname.	true

TrafficSetting.spec.outbound.reachability

↩ Parent

The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.

Name	Type	Description	Required
hosts	[]string	When the mode is CUSTOM, hosts specify the set of services that the sidecar should be able to reach.	false
mode	enum	A short cut for specifying the set of services accessed by the workload. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, CUSTOM	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index]

↩ Parent

Name	Type	Description	Required
hosts	[]string	List of hosts for which the settings will be created.	false
settings	object	A single setting to be applied to all the clients connecting to the upstream hosts.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings

↩ Parent

A single setting to be applied to all the clients connecting to the upstream hosts.

Name	Type	Description	Required
authentication	object	Configuration for connection authentication parameters.	false
loadBalancer	object	Load balancing settings for the clients.	false
resilience	object	Resilience settings for the clients.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.authentication

↩ Parent

Configuration for connection authentication parameters.

Name	Type	Description	Required
trafficMode	enum	If set to REQUIRED, client sidecars under this configuration will be configured to initiate mTLS connections using mesh-generated client certificates to services that do not have a sidecar injected. Enum: UNSET, OPTIONAL, REQUIRED	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.loadBalancer

↩ Parent

Load balancing settings for the clients.

Name	Type	Description	Required
consistentHash	object	Use consistent hash load balancing which can provide soft session affinity.	false
simple	enum	Use standard load balancing algorithms that require no tuning. Enum: UNSPECIFIED, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash

↩ Parent

Use consistent hash load balancing which can provide soft session affinity.

Name	Type	Description	Required
httpCookie	object	Hash based on HTTP cookie.	false
httpHeaderName	string	Hash based on a specific HTTP header.	false
httpQueryParameterName	string	Hash based on a specific HTTP query parameter.	false
maglev	object	The Maglev load balancer implements consistent hashing to backend hosts.	false
ringHash	object	The ring/modulo hash load balancer implements consistent hashing to backend hosts.	false
useSourceIp	boolean	Hash based on the source IP address.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.httpCookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
ttl	string	Lifetime of the cookie.	true
path	string	Path to set for the cookie.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.maglev

↩ Parent

The Maglev load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
tableSize	integer	The table size for Maglev hashing.	true

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.ringHash

↩ Parent

The ring/modulo hash load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
minimumRingSize	integer	The minimum number of virtual nodes to use for the hash ring.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.resilience

↩ Parent

Resilience settings for the clients.

Name	Type	Description	Required
circuitBreakerSensitivity	enum	Circuit breakers in Envoy are applied per endpoint in a load balancing pool. Enum: UNSET, LOW, MEDIUM, HIGH	false
connectionPool	object	Configures tolerance and other settings for TCP/HTTP connections to the service.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool

↩ Parent

Configures tolerance and other settings for TCP/HTTP connections to the service.

Name	Type	Description	Required
http	object		false
tcp	object		false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.http

↩ Parent

Name	Type	Description	Required
maxRequests	integer	Maximum number of active requests to the service.	false
maxRequestsPerConnection	integer	Maximum number of requests per connection to the service.	false
requestTimeout	string	Timeout for HTTP requests.	false
retries	object	Retry policy for HTTP requests.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.http.retries

↩ Parent

Retry policy for HTTP requests.

Name	Type	Description	Required
attempts	integer	Number of retries for a given request. Format: int32	true
perTryTimeout	string	Timeout per retry attempt for a given request.	false
retryOn	string	Specifies the conditions under which retry takes place.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp

↩ Parent

Name	Type	Description	Required
connectTimeout	string	TCP connection timeout.	false
keepAlive	object	Keep Alive Settings.	false
maxConnections	integer	Maximum number of HTTP1 /TCP connections to the service.	false

TrafficSetting.spec.outbound.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

TrafficSetting.spec.rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

TrafficSetting.spec.rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	true
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	true
rules	[]object	A set of rate limit rules.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object	Configure TLS parameters to be used when connecting to the external rate limit server.	false

TrafficSetting.spec.rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	true

TrafficSetting.spec.rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

TrafficSetting.spec.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	true
headers	map[string]object	Specifies a set of headers that the rate limit action should match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false

TrafficSetting.spec.rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

TrafficSetting.spec.rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	true
headerName	string	The header name to be queried from the request headers.	true

TrafficSetting.spec.rateLimiting.externalService.tls

↩ Parent

Configure TLS parameters to be used when connecting to the external rate limit server.

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

TrafficSetting.spec.rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string	File containing CA certificates to verify the certificates presented by the server.	false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

TrafficSetting.spec.rateLimiting.settings

↩ Parent

Name	Type	Description	Required
rules	[]object	A list of rules for ratelimiting.	true
failClosed	boolean	If the rate limit service is unavailable, the request will fail if failClosed is set to true.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

TrafficSetting.spec.rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	true
limit	object	The ratelimit value that will be configured for the above rules.	true

TrafficSetting.spec.rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

TrafficSetting.spec.rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
name	string	Name of the header to match on.	true
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
value	object	Value of the header to match on if matching on a specific value.	false

TrafficSetting.spec.rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

TrafficSetting.spec.rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	true

TrafficSetting.spec.rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit.	true
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	true

TrafficSetting.spec.reachability

↩ Parent

The set of services and hosts accessed by a workload (and hence its sidecar) in the mesh.

Name	Type	Description	Required
hosts	[]string	When the mode is CUSTOM, hosts specify the set of services that the sidecar should be able to reach.	false
mode	enum	A short cut for specifying the set of services accessed by the workload. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, CUSTOM	false

TrafficSetting.spec.resilience

↩ Parent

Resilience settings such as timeouts, retries, etc., affecting outbound traffic from proxy workloads.

Name	Type	Description	Required
circuitBreakerSensitivity	enum	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.circuitBreakerSensitivity. Enum: UNSET, LOW, MEDIUM, HIGH	false
httpRequestTimeout	string	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.http.requestTimeout.	false
httpRetries	object	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.http.retries.	false
keepAlive	object	Keep Alive Settings.	false
tcpKeepalive	boolean	Deprecated.	false

TrafficSetting.spec.resilience.httpRetries

↩ Parent

This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.http.retries.

Name	Type	Description	Required
attempts	integer	Number of retries for a given request. Format: int32	true
perTryTimeout	string	Timeout per retry attempt for a given request.	false
retryOn	string	Specifies the conditions under which retry takes place.	false

TrafficSetting.spec.resilience.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
tcp	object	TCP Keep Alive settings associated with the upstream and downstream TCP connections.	false

TrafficSetting.spec.resilience.keepAlive.tcp

↩ Parent

TCP Keep Alive settings associated with the upstream and downstream TCP connections.

Name	Type	Description	Required
downstream	object	TCP Keep Alive Settings associated with the downstream (client) connection.	false
upstream	object	This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.tcp.keepAlive.	false

TrafficSetting.spec.resilience.keepAlive.tcp.downstream

↩ Parent

TCP Keep Alive Settings associated with the downstream (client) connection.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

TrafficSetting.spec.resilience.keepAlive.tcp.upstream

↩ Parent

This field is DEPRECATED in favor of upstreamTrafficSettings.resilience.connectionPool.tcp.keepAlive.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false

TrafficSetting.spec.upstreamTrafficSettings[index]

↩ Parent

Name	Type	Description	Required
hosts	[]string	List of hosts for which the settings will be created.	false
settings	object	A single setting to be applied to all the clients connecting to the upstream hosts.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings

↩ Parent

A single setting to be applied to all the clients connecting to the upstream hosts.

Name	Type	Description	Required
authentication	object	Configuration for connection authentication parameters.	false
loadBalancer	object	Load balancing settings for the clients.	false
resilience	object	Resilience settings for the clients.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.authentication

↩ Parent

Configuration for connection authentication parameters.

Name	Type	Description	Required
trafficMode	enum	If set to REQUIRED, client sidecars under this configuration will be configured to initiate mTLS connections using mesh-generated client certificates to services that do not have a sidecar injected. Enum: UNSET, OPTIONAL, REQUIRED	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.loadBalancer

↩ Parent

Load balancing settings for the clients.

Name	Type	Description	Required
consistentHash	object	Use consistent hash load balancing which can provide soft session affinity.	false
simple	enum	Use standard load balancing algorithms that require no tuning. Enum: UNSPECIFIED, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash

↩ Parent

Use consistent hash load balancing which can provide soft session affinity.

Name	Type	Description	Required
httpCookie	object	Hash based on HTTP cookie.	false
httpHeaderName	string	Hash based on a specific HTTP header.	false
httpQueryParameterName	string	Hash based on a specific HTTP query parameter.	false
maglev	object	The Maglev load balancer implements consistent hashing to backend hosts.	false
ringHash	object	The ring/modulo hash load balancer implements consistent hashing to backend hosts.	false
useSourceIp	boolean	Hash based on the source IP address.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.httpCookie

↩ Parent

Hash based on HTTP cookie.

Name	Type	Description	Required
name	string	Name of the cookie.	true
ttl	string	Lifetime of the cookie.	true
path	string	Path to set for the cookie.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.maglev

↩ Parent

The Maglev load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
tableSize	integer	The table size for Maglev hashing.	true

TrafficSetting.spec.upstreamTrafficSettings[index].settings.loadBalancer.consistentHash.ringHash

↩ Parent

The ring/modulo hash load balancer implements consistent hashing to backend hosts.

Name	Type	Description	Required
minimumRingSize	integer	The minimum number of virtual nodes to use for the hash ring.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.resilience

↩ Parent

Resilience settings for the clients.

Name	Type	Description	Required
circuitBreakerSensitivity	enum	Circuit breakers in Envoy are applied per endpoint in a load balancing pool. Enum: UNSET, LOW, MEDIUM, HIGH	false
connectionPool	object	Configures tolerance and other settings for TCP/HTTP connections to the service.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.resilience.connectionPool

↩ Parent

Configures tolerance and other settings for TCP/HTTP connections to the service.

Name	Type	Description	Required
http	object		false
tcp	object		false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.resilience.connectionPool.http

↩ Parent

Name	Type	Description	Required
maxRequests	integer	Maximum number of active requests to the service.	false
maxRequestsPerConnection	integer	Maximum number of requests per connection to the service.	false
requestTimeout	string	Timeout for HTTP requests.	false
retries	object	Retry policy for HTTP requests.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.resilience.connectionPool.http.retries

↩ Parent

Retry policy for HTTP requests.

Name	Type	Description	Required
attempts	integer	Number of retries for a given request. Format: int32	true
perTryTimeout	string	Timeout per retry attempt for a given request.	false
retryOn	string	Specifies the conditions under which retry takes place.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp

↩ Parent

Name	Type	Description	Required
connectTimeout	string	TCP connection timeout.	false
keepAlive	object	Keep Alive Settings.	false
maxConnections	integer	Maximum number of HTTP1 /TCP connections to the service.	false

TrafficSetting.spec.upstreamTrafficSettings[index].settings.resilience.connectionPool.tcp.keepAlive

↩ Parent

Keep Alive Settings.

Name	Type	Description	Required
idleTime	integer	The number of seconds a connection needs to be idle before keep-alive probes start being sent.	false
interval	integer	The number of seconds between keep-alive probes.	false
probes	integer	The total number of unacknowledged probes to send before deciding the connection is dead.	false