438 lines
24 KiB
YAML
438 lines
24 KiB
YAML
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.5.0
|
|
creationTimestamp: null
|
|
name: tlsroutes.networking.x-k8s.io
|
|
spec:
|
|
group: networking.x-k8s.io
|
|
names:
|
|
categories:
|
|
- gateway-api
|
|
kind: TLSRoute
|
|
listKind: TLSRouteList
|
|
plural: tlsroutes
|
|
singular: tlsroute
|
|
scope: Namespaced
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: "The TLSRoute resource is similar to TCPRoute, but can be configured
|
|
to match against TLS-specific metadata. This allows more flexibility in
|
|
matching streams for a given TLS listener. \n If you need to forward traffic
|
|
to a single target for a TLS listener, you could choose to use a TCPRoute
|
|
with a TLS listener."
|
|
properties:
|
|
apiVersion:
|
|
description: 'APIVersion defines the versioned schema of this representation
|
|
of an object. Servers should convert recognized schemas to the latest
|
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
type: string
|
|
kind:
|
|
description: 'Kind is a string value representing the REST resource this
|
|
object represents. Servers may infer this from the endpoint the client
|
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: Spec defines the desired state of TLSRoute.
|
|
properties:
|
|
gateways:
|
|
default:
|
|
allow: SameNamespace
|
|
description: Gateways defines which Gateways can use this Route.
|
|
properties:
|
|
allow:
|
|
default: SameNamespace
|
|
description: 'Allow indicates which Gateways will be allowed to
|
|
use this route. Possible values are: * All: Gateways in any
|
|
namespace can use this route. * FromList: Only Gateways specified
|
|
in GatewayRefs may use this route. * SameNamespace: Only Gateways
|
|
in the same namespace may use this route.'
|
|
enum:
|
|
- All
|
|
- FromList
|
|
- SameNamespace
|
|
type: string
|
|
gatewayRefs:
|
|
description: GatewayRefs must be specified when Allow is set to
|
|
"FromList". In that case, only Gateways referenced in this list
|
|
will be allowed to use this route. This field is ignored for
|
|
other values of "Allow".
|
|
items:
|
|
description: GatewayReference identifies a Gateway in a specified
|
|
namespace.
|
|
properties:
|
|
name:
|
|
description: Name is the name of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
namespace:
|
|
description: Namespace is the namespace of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- name
|
|
- namespace
|
|
type: object
|
|
type: array
|
|
type: object
|
|
rules:
|
|
description: Rules are a list of TLS matchers and actions.
|
|
items:
|
|
description: TLSRouteRule is the configuration for a given rule.
|
|
properties:
|
|
forwardTo:
|
|
description: ForwardTo defines the backend(s) where matching
|
|
requests should be sent.
|
|
items:
|
|
description: RouteForwardTo defines how a Route should forward
|
|
a request.
|
|
properties:
|
|
backendRef:
|
|
description: "BackendRef is a reference to a backend to
|
|
forward matched requests to. If both BackendRef and
|
|
ServiceName are specified, ServiceName will be given
|
|
precedence. \n If the referent cannot be found, the
|
|
rule is not included in the route. The controller should
|
|
raise the \"ResolvedRefs\" condition on the Gateway
|
|
with the \"DegradedRoutes\" reason. The gateway status
|
|
for this route should be updated with a condition that
|
|
describes the error more specifically. \n Support: Custom"
|
|
properties:
|
|
group:
|
|
description: Group is the group of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
kind:
|
|
description: Kind is kind of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
name:
|
|
description: Name is the name of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- group
|
|
- kind
|
|
- name
|
|
type: object
|
|
port:
|
|
description: "Port specifies the destination port number
|
|
to use for the backend referenced by the ServiceName
|
|
or BackendRef field. If unspecified, the destination
|
|
port in the request is used when forwarding to a backendRef
|
|
or serviceName. \n Support: Core"
|
|
format: int32
|
|
maximum: 65535
|
|
minimum: 1
|
|
type: integer
|
|
serviceName:
|
|
description: "ServiceName refers to the name of the Service
|
|
to forward matched requests to. When specified, this
|
|
takes the place of BackendRef. If both BackendRef and
|
|
ServiceName are specified, ServiceName will be given
|
|
precedence. \n If the referent cannot be found, the
|
|
rule is not included in the route. The controller should
|
|
raise the \"ResolvedRefs\" condition on the Gateway
|
|
with the \"DegradedRoutes\" reason. The gateway status
|
|
for this route should be updated with a condition that
|
|
describes the error more specifically. \n The protocol
|
|
to use is defined using AppProtocol field (introduced
|
|
in Kubernetes 1.18) in the Service resource. In the
|
|
absence of the AppProtocol field a `networking.x-k8s.io/app-protocol`
|
|
annotation on the BackendPolicy resource may be used
|
|
to define the protocol. If the AppProtocol field is
|
|
available, this annotation should not be used. The AppProtocol
|
|
field, when populated, takes precedence over the annotation
|
|
in the BackendPolicy resource. For custom backends,
|
|
it is encouraged to add a semantically-equivalent field
|
|
in the Custom Resource Definition. \n Support: Core"
|
|
maxLength: 253
|
|
type: string
|
|
weight:
|
|
default: 1
|
|
description: "Weight specifies the proportion of HTTP
|
|
requests forwarded to the backend referenced by the
|
|
ServiceName or BackendRef field. This is computed as
|
|
weight/(sum of all weights in this ForwardTo list).
|
|
For non-zero values, there may be some epsilon from
|
|
the exact proportion defined here depending on the precision
|
|
an implementation supports. Weight is not a percentage
|
|
and the sum of weights does not need to equal 100. \n
|
|
If only one backend is specified and it has a weight
|
|
greater than 0, 100% of the traffic is forwarded to
|
|
that backend. If weight is set to 0, no traffic should
|
|
be forwarded for this entry. If unspecified, weight
|
|
defaults to 1. \n Support: Extended"
|
|
format: int32
|
|
maximum: 1000000
|
|
minimum: 0
|
|
type: integer
|
|
type: object
|
|
maxItems: 16
|
|
minItems: 1
|
|
type: array
|
|
matches:
|
|
description: "Matches define conditions used for matching the
|
|
rule against incoming TLS connections. Each match is independent,
|
|
i.e. this rule will be matched if **any** one of the matches
|
|
is satisfied. If unspecified (i.e. empty), this Rule will
|
|
match all requests for the associated Listener. \n Each client
|
|
request MUST map to a maximum of one route rule. If a request
|
|
matches multiple rules, matching precedence MUST be determined
|
|
in order of the following criteria, continuing on ties: \n
|
|
* The longest matching SNI. * The longest matching precise
|
|
SNI (without a wildcard). This means that \"b.example.com\"
|
|
should be given precedence over \"*.example.com\". * The most
|
|
specific match specified by ExtensionRef. Each implementation
|
|
\ that supports ExtensionRef may have different ways of determining
|
|
the specificity of the referenced extension. \n If ties
|
|
still exist across multiple Routes, matching precedence MUST
|
|
be determined in order of the following criteria, continuing
|
|
on ties: \n * The oldest Route based on creation timestamp.
|
|
For example, a Route with a creation timestamp of \"2020-09-08
|
|
01:02:03\" is given precedence over a Route with a creation
|
|
timestamp of \"2020-09-08 01:02:04\". * The Route appearing
|
|
first in alphabetical order by \"<namespace>/<name>\". For
|
|
example, foo/bar is given precedence over foo/baz. \n If
|
|
ties still exist within the Route that has been given precedence,
|
|
matching precedence MUST be granted to the first matching
|
|
rule meeting the above criteria."
|
|
items:
|
|
description: TLSRouteMatch defines the predicate used to match
|
|
connections to a given action.
|
|
properties:
|
|
extensionRef:
|
|
description: "ExtensionRef is an optional, implementation-specific
|
|
extension to the \"match\" behavior. For example, resource
|
|
\"mytlsroutematcher\" in group \"networking.acme.io\".
|
|
If the referent cannot be found, the rule is not included
|
|
in the route. The controller should raise the \"ResolvedRefs\"
|
|
condition on the Gateway with the \"DegradedRoutes\"
|
|
reason. The gateway status for this route should be
|
|
updated with a condition that describes the error more
|
|
specifically. \n Support: Custom"
|
|
properties:
|
|
group:
|
|
description: Group is the group of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
kind:
|
|
description: Kind is kind of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
name:
|
|
description: Name is the name of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- group
|
|
- kind
|
|
- name
|
|
type: object
|
|
snis:
|
|
description: "SNIs defines a set of SNI names that should
|
|
match against the SNI attribute of TLS ClientHello message
|
|
in TLS handshake. \n SNI can be \"precise\" which is
|
|
a domain name without the terminating dot of a network
|
|
host (e.g. \"foo.example.com\") or \"wildcard\", which
|
|
is a domain name prefixed with a single wildcard label
|
|
(e.g. `*.example.com`). The wildcard character `*` must
|
|
appear by itself as the first DNS label and matches
|
|
only a single label. You cannot have a wildcard label
|
|
by itself (e.g. Host == `*`). \n Requests will be matched
|
|
against the Host field in the following order: \n 1.
|
|
If SNI is precise, the request matches this rule if
|
|
the SNI in ClientHello is equal to one of the defined
|
|
SNIs. 2. If SNI is a wildcard, then the request matches
|
|
this rule if the SNI is to equal to the suffix (removing
|
|
the first label) of the wildcard rule. 3. If SNIs
|
|
is unspecified, all requests associated with the gateway
|
|
TLS listener will match. This can be used to define
|
|
a default backend for a TLS listener. \n Support:
|
|
Core"
|
|
items:
|
|
description: Hostname is used to specify a hostname
|
|
that should be matched.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
maxItems: 16
|
|
type: array
|
|
type: object
|
|
maxItems: 8
|
|
type: array
|
|
required:
|
|
- forwardTo
|
|
type: object
|
|
maxItems: 16
|
|
minItems: 1
|
|
type: array
|
|
required:
|
|
- rules
|
|
type: object
|
|
status:
|
|
description: Status defines the current state of TLSRoute.
|
|
properties:
|
|
gateways:
|
|
description: "Gateways is a list of Gateways that are associated with
|
|
the route, and the status of the route with respect to each Gateway.
|
|
When a Gateway selects this route, the controller that manages the
|
|
Gateway must add an entry to this list when the controller first
|
|
sees the route and should update the entry as appropriate when the
|
|
route is modified. \n A maximum of 100 Gateways will be represented
|
|
in this list. If this list is full, there may be additional Gateways
|
|
using this Route that are not included in the list. An empty list
|
|
means the route has not been admitted by any Gateway."
|
|
items:
|
|
description: RouteGatewayStatus describes the status of a route
|
|
with respect to an associated Gateway.
|
|
properties:
|
|
conditions:
|
|
description: Conditions describes the status of the route with
|
|
respect to the Gateway. The "Admitted" condition must always
|
|
be specified by controllers to indicate whether the route
|
|
has been admitted or rejected by the Gateway, and why. Note
|
|
that the route's availability is also subject to the Gateway's
|
|
own status conditions and listener status.
|
|
items:
|
|
description: "Condition contains details for one aspect of
|
|
the current state of this API Resource. --- This struct
|
|
is intended for direct use as an array at the field path
|
|
.status.conditions. For example, type FooStatus struct{
|
|
\ // Represents the observations of a foo's current state.
|
|
\ // Known .status.conditions.type are: \"Available\",
|
|
\"Progressing\", and \"Degraded\" // +patchMergeKey=type
|
|
\ // +patchStrategy=merge // +listType=map //
|
|
+listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
|
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
|
|
\n // other fields }"
|
|
properties:
|
|
lastTransitionTime:
|
|
description: lastTransitionTime is the last time the condition
|
|
transitioned from one status to another. This should
|
|
be when the underlying condition changed. If that is
|
|
not known, then using the time when the API field changed
|
|
is acceptable.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: message is a human readable message indicating
|
|
details about the transition. This may be an empty string.
|
|
maxLength: 32768
|
|
type: string
|
|
observedGeneration:
|
|
description: observedGeneration represents the .metadata.generation
|
|
that the condition was set based upon. For instance,
|
|
if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
|
|
is 9, the condition is out of date with respect to the
|
|
current state of the instance.
|
|
format: int64
|
|
minimum: 0
|
|
type: integer
|
|
reason:
|
|
description: reason contains a programmatic identifier
|
|
indicating the reason for the condition's last transition.
|
|
Producers of specific condition types may define expected
|
|
values and meanings for this field, and whether the
|
|
values are considered a guaranteed API. The value should
|
|
be a CamelCase string. This field may not be empty.
|
|
maxLength: 1024
|
|
minLength: 1
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
type: string
|
|
status:
|
|
description: status of the condition, one of True, False,
|
|
Unknown.
|
|
enum:
|
|
- "True"
|
|
- "False"
|
|
- Unknown
|
|
type: string
|
|
type:
|
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
--- Many .condition.type values are consistent across
|
|
resources like Available, but because arbitrary conditions
|
|
can be useful (see .node.status.conditions), the ability
|
|
to deconflict is important. The regex it matches is
|
|
(dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
required:
|
|
- lastTransitionTime
|
|
- message
|
|
- reason
|
|
- status
|
|
- type
|
|
type: object
|
|
maxItems: 8
|
|
type: array
|
|
x-kubernetes-list-map-keys:
|
|
- type
|
|
x-kubernetes-list-type: map
|
|
gatewayRef:
|
|
description: GatewayRef is a reference to a Gateway object that
|
|
is associated with the route.
|
|
properties:
|
|
controller:
|
|
description: "Controller is a domain/path string that indicates
|
|
the controller implementing the Gateway. This corresponds
|
|
with the controller field on GatewayClass. \n Example:
|
|
\"acme.io/gateway-controller\". \n The format of this
|
|
field is DOMAIN \"/\" PATH, where DOMAIN and PATH are
|
|
valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names)."
|
|
maxLength: 253
|
|
type: string
|
|
name:
|
|
description: Name is the name of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
namespace:
|
|
description: Namespace is the namespace of the referent.
|
|
maxLength: 253
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- name
|
|
- namespace
|
|
type: object
|
|
required:
|
|
- gatewayRef
|
|
type: object
|
|
maxItems: 100
|
|
type: array
|
|
required:
|
|
- gateways
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
status:
|
|
acceptedNames:
|
|
kind: ""
|
|
plural: ""
|
|
conditions: []
|
|
storedVersions: []
|