v1alpha3

type Abort struct {
	// REQUIRED. HTTP status code to use to abort the Http request.
	HTTPStatus int `json:"httpStatus"`

	// Percentage of requests on which the delay will be injected.
	Percentage *Percentage `json:"percentage,omitempty"`
}

type ApplyTo string

type CaptureMode string

type ClusterMatch struct {
	// The service port for which this cluster was generated.  If
	// omitted, applies to clusters for any port.
	PortNumber uint32 `json:"portNumber,omitempty"`
	// The fully qualified service name for this cluster. If omitted,
	// applies to clusters for any service. For services defined
	// through service entries, the service name is same as the hosts
	// defined in the service entry.
	Service string `json:"service,omitempty"`
	// The subset associated with the service. If omitted, applies to
	// clusters for any subset of a service.
	Subset string `json:"subset,omitempty"`
	// The exact name of the cluster to match. To match a specific
	// cluster by name, such as the internally generated "Passthrough"
	// cluster, leave all fields in clusterMatch empty, except the
	// name.
	Name string `json:"name,omitempty"`
}

type ConnectionPoolSettings struct {
	// Settings common to both HTTP and TCP upstream connections.
	TCP *TCPSettings `json:"tcp,omitempty"`

	// HTTP connection pool settings.
	HTTP *HTTPSettings `json:"http,omitempty"`
}

type ConsistentHashLB struct {
	// It is required to specify exactly one of these fields as hash key
	// HTTPHeaderName, HTTPCookie, or UseSourceIP.
	// Hash based on a specific HTTP header.
	HTTPHeaderName *string `json:"httpHeaderName,omitempty"`

	// Hash based on HTTP cookie.
	HTTPCookie *HTTPCookie `json:"httpCookie,omitempty"`

	// Hash based on the source IP address.
	UseSourceIP *bool `json:"useSourceIp,omitempty"`

	// The minimum number of virtual nodes to use for the hash
	// ring. Defaults to 1024. Larger ring sizes result in more granular
	// load distributions. If the number of hosts in the load balancing
	// pool is larger than the ring size, each host will be assigned a
	// single virtual node.
	MinimumRingSize *uint64 `json:"minimumRingSize,omitempty"`
}

type CorsPolicy struct {
	// The list of origins that are allowed to perform CORS requests. The
	// content will be serialized into the Access-Control-Allow-Origin
	// header. Wildcard * will allow all origins.
	AllowOrigin []string `json:"allowOrigin,omitempty"`

	// List of HTTP methods allowed to access the resource. The content will
	// be serialized into the Access-Control-Allow-Methods header.
	AllowMethods []string `json:"allowMethods,omitempty"`

	// List of HTTP headers that can be used when requesting the
	// resource. Serialized to Access-Control-Allow-Methods header.
	AllowHeaders []string `json:"allowHeaders,omitempty"`

	// A white list of HTTP headers that the browsers are allowed to
	// access. Serialized into Access-Control-Expose-Headers header.
	ExposeHeaders []string `json:"exposeHeaders,omitempty"`

	// Specifies how long the results of a preflight request can be
	// cached. Translates to the `Access-Control-Max-Age` header.
	MaxAge *string `json:"maxAge,omitempty"`

	// Indicates whether the caller is allowed to send the actual request
	// (not the preflight) using credentials. Translates to
	// `Access-Control-Allow-Credentials` header.
	AllowCredentials *bool `json:"allowCredentials,omitempty"`
}

type Delay struct {
	// REQUIRED. Add a fixed delay before forwarding the request. Format:
	// 1h/1m/1s/1ms. MUST be >=1ms.
	FixedDelay string `json:"fixedDelay"`

	// Percentage of requests on which the delay will be injected.
	Percentage *Percentage `json:"percentage,omitempty"`
}

type Destination struct {
	// REQUIRED. The name of a service from the service registry. Service
	// names are looked up from the platform's service registry (e.g.,
	// Kubernetes services, Consul services, etc.) and from the hosts
	// declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/v1alpha3/service-entry/#ServiceEntry). Traffic forwarded to
	// destinations that are not found in either of the two, will be dropped.
	//
	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
	// the short name based on the namespace of the rule, not the service. A
	// rule in the "default" namespace containing a host "reviews will be
	// interpreted as "reviews.default.svc.cluster.local", irrespective of
	// the actual namespace associated with the reviews service. _To avoid
	// potential misconfigurations, it is recommended to always use fully
	// qualified domain names over short names._
	Host string `json:"host"`

	// The name of a subset within the service. Applicable only to services
	// within the mesh. The subset must be defined in a corresponding
	// DestinationRule.
	Subset *string `json:"subset,omitempty"`

	// Specifies the port on the host that is being addressed. If a service
	// exposes only a single port it is not required to explicitly select the
	// port.
	Port *PortSelector `json:"port,omitempty"`
}

type DestinationRule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              DestinationRuleSpec `json:"spec"`
}

type DestinationRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []DestinationRule `json:"items"`
}

type DestinationRuleSpec struct {
	// REQUIRED. The name of a service from the service registry. Service
	// names are looked up from the platform's service registry (e.g.,
	// Kubernetes services, Consul services, etc.) and from the hosts
	// declared by [ServiceEntries](https://istio.io/docs/reference/config/networking/v1alpha3/service-entry/#ServiceEntry). Rules defined for
	// services that do not exist in the service registry will be ignored.
	//
	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
	// the short name based on the namespace of the rule, not the service. A
	// rule in the "default" namespace containing a host "reviews" will be
	// interpreted as "reviews.default.svc.cluster.local", irrespective of
	// the actual namespace associated with the reviews service. _To avoid
	// potential misconfigurations, it is recommended to always use fully
	// qualified domain names over short names._
	//
	// Note that the host field applies to both HTTP and TCP services.
	Host string `json:"host"`

	// Traffic policies to apply (load balancing policy, connection pool
	// sizes, outlier detection).
	TrafficPolicy *TrafficPolicy `json:"trafficPolicy,omitempty"`

	// One or more named sets that represent individual versions of a
	// service. Traffic policies can be overridden at subset level.
	Subsets []Subset `json:"subsets,omitempty"`

	// A list of namespaces to which this destination rule is exported.
	// The resolution of a destination rule to apply to a service occurs in the
	// context of a hierarchy of namespaces. Exporting a destination rule allows
	// it to be included in the resolution hierarchy for services in
	// other namespaces. This feature provides a mechanism for service owners
	// and mesh administrators to control the visibility of destination rules
	// across namespace boundaries.
	//
	// If no namespaces are specified then the destination rule is exported to all
	// namespaces by default.
	//
	// The value "." is reserved and defines an export to the same namespace that
	// the destination rule is declared in. Similarly, the value "*" is reserved and
	// defines an export to all namespaces.
	//
	// NOTE: in the current release, the `exportTo` value is restricted to
	// "." or "*" (i.e., the current namespace or all namespaces).
	ExportTo []string `json:"exportTo,omitempty"`
}

type EnvoyConfigObjectMatch struct {
	// The specific config generation context to match on. Istio Pilot
	// generates envoy configuration in the context of a gateway,
	// inbound traffic to sidecar and outbound traffic from sidecar.
	Context PatchContext `json:"context"`
	// Match on properties associated with a proxy.
	Proxy *ProxyMatch `json:"proxy,omitempty"`
	// Types that are valid to be assigned to ObjectTypes:
	//	*Listener
	//	*RouteConfiguration
	//	*Cluster
	Listener           *ListenerMatch           `json:"listener,omitempty"`
	RouteConfiguration *RouteConfigurationMatch `json:"routeConfiguration,omitempty"`
	Cluster            *ClusterMatch            `json:"cluster,omitempty"`
}

type EnvoyConfigObjectPatch struct {
	// Specifies where in the Envoy configuration, the patch should be
	// applied.  The match is expected to select the appropriate
	// object based on applyTo.  For example, an applyTo with
	// HTTP_FILTER is expected to have a match condition on the
	// listeners, with a network filter selection on
	// envoy.http_connection_manager and a sub filter selection on the
	// HTTP filter relative to which the insertion should be
	// performed. Similarly, an applyTo on CLUSTER should have a match
	// (if provided) on the cluster and not on a listener.
	ApplyTo ApplyTo `json:"applyTo,omitempty"`
	// Match on listener/route configuration/cluster.
	Match *EnvoyConfigObjectMatch `json:"match,omitempty"`
	// The patch to apply along with the operation.
	Patch *Patch `json:"patch,omitempty"`
}

type EnvoyFilter struct {
	v1.TypeMeta `json:",inline"`
	// +optional
	v1.ObjectMeta `json:"metadata,omitempty"`

	// Spec defines the implementation of this definition.
	// +optional
	Spec EnvoyFilterSpec `json:"spec,omitempty"`
}

type EnvoyFilterList struct {
	v1.TypeMeta `json:",inline"`
	// +optional
	v1.ListMeta `json:"metadata"`
	Items       []EnvoyFilter `json:"items"`
}

type EnvoyFilterSpec struct {
	WorkloadSelector *WorkloadSelector `json:"workloadSelector,omitempty"`
	// One or more patches with match conditions.
	ConfigPatches []*EnvoyConfigObjectPatch `json:"configPatches,omitempty"`
}

type ExecHealthCheckConfig struct {
	// Command to run. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
	Command []string `json:"command,omitempty"`
}

type FilterChainMatch struct {
	// The name assigned to the filter chain.
	Name string `json:"name,omitempty"`
	// The SNI value used by a filter chain's match condition.  This
	// condition will evaluate to false if the filter chain has no
	// sni match.
	SNI string `json:"sni,omitempty"`
	// Applies only to SIDECAR_INBOUND context. If non-empty, a
	// transport protocol to consider when determining a filter
	// chain match.  This value will be compared against the
	// transport protocol of a new connection, when it's detected by
	// the tls_inspector listener filter.
	//
	// Accepted values include:
	//
	// * `raw_buffer` - default, used when no transport protocol is detected.
	// * `tls` - set when TLS protocol is detected by the TLS inspector.
	TransportProtocol string `json:"transportProtocol,omitempty"`
	// Applies only to sidecars. If non-empty, a comma separated set
	// of application protocols to consider when determining a
	// filter chain match.  This value will be compared against the
	// application protocols of a new connection, when it's detected
	// by one of the listener filters such as the http_inspector.
	//
	// Accepted values include: h2,http/1.1,http/1.0
	ApplicationProtocols string `json:"applicationProtocols,omitempty"`
	// The name of a specific filter to apply the patch to. Set this
	// to envoy.http_connection_manager to add a filter or apply a
	// patch to the HTTP connection manager.
	Filter *FilterMatch `json:"filter,omitempty"`
}

type FilterMatch struct {
	// The filter name to match on.
	Name string `json:"name,omitempty"`
	// The next level filter within this filter to match
	// upon. Typically used for HTTP Connection Manager filters and
	// Thrift filters.
	SubFilter *SubFilterMatch `json:"subFilter,omitempty"`
}

type Gateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec GatewaySpec `json:"spec"`
}

type GatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []Gateway `json:"items"`
}

type GatewaySpec struct {
	// REQUIRED: A list of server specifications.
	Servers []Server `json:"servers"`

	// REQUIRED: One or more labels that indicate a specific set of pods/VMs
	// on which this gateway configuration should be applied. The scope of
	// label search is restricted to the configuration namespace in which the
	// the resource is present. In other words, the Gateway resource must
	// reside in the same namespace as the gateway workload instance.
	Selector map[string]string `json:"selector,omitempty"`
}

type H2UpgradePolicy string

type HTTPCookie struct {
	// REQUIRED. Name of the cookie.
	Name string `json:"name"`

	// Path to set for the cookie.
	Path *string `json:"path,omitempty"`

	// REQUIRED. Lifetime of the cookie.
	TTL string `json:"ttl"`
}

type HTTPFaultInjection struct {
	// Delay requests before forwarding, emulating various failures such as
	// network issues, overloaded upstream service, etc.
	Delay *Delay `json:"delay,omitempty"`

	// Abort Http request attempts and return error codes back to downstream
	// service, giving the impression that the upstream service is faulty.
	Abort *Abort `json:"abort,omitempty"`
}

type HTTPHeader struct {
	// The header field name
	Name string `json:"name,omitempty"`
	// The header field value
	Value string `json:"value,omitempty"`
}

type HTTPHealthCheckConfig struct {
	// Path to access on the HTTP server.
	Path string `json:"path,omitempty"`
	// REQUIRED. Port on which the endpoint lives.
	Port uint32 `json:"port"`
	// Host to connect to, defaults to the pod IP. You probably want to set
	// "Host" in httpHeaders instead.
	Host string `json:"host,omitempty"`
	// HTTP or HTTPS, defaults to HTTP.
	Scheme string `json:"scheme,omitempty"`
	// Headers the proxy will pass on to make the request.
	// Allows repeated headers.
	HTTPHeaders []*HTTPHeader `json:"httpHeaders,omitempty"`
}

type HTTPMatchRequest struct {
	// The name assigned to a match. The match's name will be
	// concatenated with the parent route's name and will be logged in
	// the access logs for requests matching this route.
	Name *string `json:"name,omitempty"`

	// URI to match
	// values are case-sensitive and formatted as follows:
	//
	// - `exact: "value"` for exact string match
	//
	// - `prefix: "value"` for prefix-based match
	//
	// - `regex: "value"` for ECMAscript style regex-based match
	//
	// **Note:** Case-insensitive matching could be enabled via the
	// `ignore_uri_case` flag.
	URI *v1alpha1.StringMatch `json:"uri,omitempty"`

	// URI Scheme
	// values are case-sensitive and formatted as follows:
	//
	// - `exact: "value"` for exact string match
	//
	// - `prefix: "value"` for prefix-based match
	//
	// - `regex: "value"` for ECMAscript style regex-based match
	//
	Scheme *v1alpha1.StringMatch `json:"scheme,omitempty"`

	// HTTP Method
	// values are case-sensitive and formatted as follows:
	//
	// - `exact: "value"` for exact string match
	//
	// - `prefix: "value"` for prefix-based match
	//
	// - `regex: "value"` for ECMAscript style regex-based match
	//
	Method *v1alpha1.StringMatch `json:"method,omitempty"`

	// HTTP Authority
	// values are case-sensitive and formatted as follows:
	//
	// - `exact: "value"` for exact string match
	//
	// - `prefix: "value"` for prefix-based match
	//
	// - `regex: "value"` for ECMAscript style regex-based match
	//
	Authority *v1alpha1.StringMatch `json:"authority,omitempty"`

	// The header keys must be lowercase and use hyphen as the separator,
	// e.g. _x-request-id_.
	//
	// Header values are case-sensitive and formatted as follows:
	//
	// - `exact: "value"` for exact string match
	//
	// - `prefix: "value"` for prefix-based match
	//
	// - `regex: "value"` for ECMAscript style regex-based match
	//
	// **Note:** The keys `uri`, `scheme`, `method`, and `authority` will be ignored.
	Headers map[string]v1alpha1.StringMatch `json:"headers,omitempty"`

	// Specifies the ports on the host that is being addressed. Many services
	// only expose a single port or label ports with the protocols they support,
	// in these cases it is not required to explicitly select the port.
	Port *uint32 `json:"port,omitempty"`

	// One or more labels that constrain the applicability of a rule to
	// workloads with the given labels. If the VirtualService has a list of
	// gateways specified at the top, it must include the reserved gateway
	// `mesh` for this field to be applicable.
	SourceLabels map[string]string `json:"sourceLabels,omitempty"`

	// Query parameters for matching.
	//
	// Ex:
	// - For a query parameter like "?key=true", the map key would be "key" and
	//   the string match could be defined as `exact: "true"`.
	// - For a query parameter like "?key", the map key would be "key" and the
	//   string match could be defined as `exact: ""`.
	// - For a query parameter like "?key=123", the map key would be "key" and the
	//   string match could be defined as `regex: "\d+$"`. Note that this
	//   configuration will only match values like "123" but not "a123" or "123a".
	//
	// **Note:** `prefix` matching is currently not supported.
	QueryParams map[string]*v1alpha1.StringMatch `json:"queryParams,omitempty"`

	// Flag to specify whether the URI matching should be case-insensitive.
	//
	// **Note:** The case will be ignored only in the case of `exact` and `prefix`
	// URI matches.
	IgnoreURICase *bool `json:"ignoreUriCase,omitempty"`
}

type HTTPRedirect struct {
	// On a redirect, overwrite the Path portion of the URL with this
	// value. Note that the entire path will be replaced, irrespective of the
	// request URI being matched as an exact path or prefix.
	URI *string `json:"uri,omitempty"`

	// On a redirect, overwrite the Authority/Host portion of the URL with
	// this value.
	Authority *string `json:"authority,omitempty"`

	// On a redirect, Specifies the HTTP status code to use in the redirect
	// response. The default response code is MOVED_PERMANENTLY (301).
	RedirectCode *uint32 `json:"redirectCode,omitempty"`
}

type HTTPRetry struct {
	// REQUIRED. Number of retries for a given request. The interval
	// between retries will be determined automatically (25ms+). Actual
	// number of retries attempted depends on the httpReqTimeout.
	Attempts int `json:"attempts"`

	// Timeout per retry attempt for a given request. format: 1h/1m/1s/1ms. MUST BE >=1ms.
	PerTryTimeout string `json:"perTryTimeout"`

	// Specifies the conditions under which retry takes place.
	// One or more policies can be specified using a ‘,’ delimited list.
	// See the [retry policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on)
	// and [gRPC retry policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on) for more details.
	RetryOn *string `json:"retryOn,omitempty"`
}

type HTTPRewrite struct {
	// rewrite the path (or the prefix) portion of the URI with this
	// value. If the original URI was matched based on prefix, the value
	// provided in this field will replace the corresponding matched prefix.
	URI *string `json:"uri,omitempty"`

	// rewrite the Authority/Host header with this value.
	Authority *string `json:"authority,omitempty"`
}

type HTTPRoute struct {
	// The name assigned to the route for debugging purposes. The
	// route's name will be concatenated with the match's name and will
	// be logged in the access logs for requests matching this
	// route/match.
	Name *string `json:"name,omitempty"`

	// Match conditions to be satisfied for the rule to be
	// activated. All conditions inside a single match block have AND
	// semantics, while the list of match blocks have OR semantics. The rule
	// is matched if any one of the match blocks succeed.
	Match []*HTTPMatchRequest `json:"match,omitempty"`

	// A http rule can either redirect or forward (default) traffic. The
	// forwarding target can be one of several versions of a service (see
	// glossary in beginning of document). Weights associated with the
	// service version determine the proportion of traffic it receives.
	Route []*HTTPRouteDestination `json:"route,omitempty"`

	// A http rule can either redirect or forward (default) traffic. If
	// traffic passthrough option is specified in the rule,
	// route/redirect will be ignored. The redirect primitive can be used to
	// send a HTTP 301 redirect to a different URI or Authority.
	Redirect *HTTPRedirect `json:"redirect,omitempty"`

	// Rewrite HTTP URIs and Authority headers. Rewrite cannot be used with
	// Redirect primitive. Rewrite will be performed before forwarding.
	Rewrite *HTTPRewrite `json:"rewrite,omitempty"`

	// Timeout for HTTP requests.
	Timeout *string `json:"timeout,omitempty"`

	// Retry policy for HTTP requests.
	Retries *HTTPRetry `json:"retries,omitempty"`

	// Fault injection policy to apply on HTTP traffic at the client side.
	// Note that timeouts or retries will not be enabled when faults are
	// enabled on the client side.
	Fault *HTTPFaultInjection `json:"fault,omitempty"`

	// Mirror HTTP traffic to a another destination in addition to forwarding
	// the requests to the intended destination. Mirrored traffic is on a
	// best effort basis where the sidecar/gateway will not wait for the
	// mirrored cluster to respond before returning the response from the
	// original destination.  Statistics will be generated for the mirrored
	// destination.
	Mirror *Destination `json:"mirror,omitempty"`

	// Percentage of the traffic to be mirrored by the `mirror` field.
	// Use of integer `mirror_percent` value is deprecated. Use the
	// double `mirror_percentage` field instead
	MirrorPercent *uint32 `json:"mirrorPercent,omitempty"`

	// Percentage of the traffic to be mirrored by the `mirror` field.
	// If this field is absent, all the traffic (100%) will be mirrored.
	// Max value is 100.
	MirrorPercentage *Percentage `json:"mirrorPercentage,omitempty"`

	// Cross-Origin Resource Sharing policy (CORS). Refer to
	// [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
	// for further details about cross origin resource sharing.
	CorsPolicy *CorsPolicy `json:"corsPolicy,omitempty"`

	// Header manipulation rules
	Headers *Headers `json:"headers,omitempty"`
}

type HTTPRouteDestination struct {
	// REQUIRED. Destination uniquely identifies the instances of a service
	// to which the request/connection should be forwarded to.
	Destination *Destination `json:"destination"`

	// REQUIRED. The proportion of traffic to be forwarded to the service
	// version. (0-100). Sum of weights across destinations SHOULD BE == 100.
	// If there is only one destination in a rule, the weight value is assumed to
	// be 100.
	Weight *int `json:"weight,omitempty"`

	// Header manipulation rules
	Headers *Headers `json:"headers,omitempty"`
}

type HTTPSettings struct {
	// Maximum number of pending HTTP requests to a destination. Default 1024.
	HTTP1MaxPendingRequests *int32 `json:"http1MaxPendingRequests,omitempty"`

	// Maximum number of requests to a backend. Default 1024.
	HTTP2MaxRequests *int32 `json:"http2MaxRequests,omitempty"`

	// Maximum number of requests per connection to a backend. Setting this
	// parameter to 1 disables keep alive.
	MaxRequestsPerConnection *int32 `json:"maxRequestsPerConnection,omitempty"`

	// Maximum number of retries that can be outstanding to all hosts in a
	// cluster at a given time. Defaults to 3.
	MaxRetries *int32 `json:"maxRetries,omitempty"`

	// The idle timeout for upstream connection pool connections. The idle timeout is defined as the period in which there are no active requests.
	// If not set, there is no idle timeout. When the idle timeout is reached the connection will be closed.
	// Note that request based timeouts mean that HTTP/2 PINGs will not keep the connection alive. Applies to both HTTP1.1 and HTTP2 connections.
	IdleTimeout *string `json:"idleTimeout,omitempty"`

	// Specify if http1.1 connection should be upgraded to http2 for the associated destination.
	H2UpgradePolicy *H2UpgradePolicy `json:"h2UpgradePolicy,omitempty"`
}

type HeaderOperations struct {
	// Overwrite the headers specified by key with the given values
	Set map[string]string `json:"set,omitempty"`

	// Append the given values to the headers specified by keys
	// (will create a comma-separated list of values)
	Add map[string]string `json:"add,omitempty"`

	// Remove a the specified headers
	Remove []string `json:"remove,omitempty"`
}

type Headers struct {
	// Header manipulation rules to apply before forwarding a request
	// to the destination service
	Request *HeaderOperations `json:"request,omitempty"`

	// Header manipulation rules to apply before returning a response
	// to the caller
	Response *HeaderOperations `json:"response,omitempty"`
}

type IstioEgressListener struct {
	// The port associated with the listener. If using Unix domain socket,
	// use 0 as the port number, with a valid protocol. The port if
	// specified, will be used as the default destination port associated
	// with the imported hosts. If the port is omitted, Istio will infer the
	// listener ports based on the imported hosts. Note that when multiple
	// egress listeners are specified, where one or more listeners have
	// specific ports while others have no port, the hosts exposed on a
	// listener port will be based on the listener with the most specific
	// port.
	Port *Port `json:"port,omitempty"`
	// The IP or the Unix domain socket to which the listener should be bound
	// to. Port MUST be specified if bind is not empty. Format: `x.x.x.x` or
	// `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). If
	// omitted, Istio will automatically configure the defaults based on imported
	// services, the workload instances to which this configuration is applied to and
	// the captureMode. If captureMode is `NONE`, bind will default to
	// 127.0.0.1.
	Bind string `json:"bind,omitempty"`
	// When the bind address is an IP, the captureMode option dictates
	// how traffic to the listener is expected to be captured (or not).
	// captureMode must be DEFAULT or `NONE` for Unix domain socket binds.
	CaptureMode CaptureMode `json:"captureMode,omitempty"`
	// One or more service hosts exposed by the listener
	// in `namespace/dnsName` format. Services in the specified namespace
	// matching `dnsName` will be exposed.
	// The corresponding service can be a service in the service registry
	// (e.g., a Kubernetes or cloud foundry service) or a service specified
	// using a `ServiceEntry` or `VirtualService` configuration. Any
	// associated `DestinationRule` in the same namespace will also be used.
	//
	// The `dnsName` should be specified using FQDN format, optionally including
	// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
	// Set the `dnsName` to `*` to select all services from the specified namespace
	// (e.g., `prod/*`).
	//
	// The `namespace` can be set to `*`, `.`, or `~`, representing any, the current,
	// or no namespace, respectively. For example, `*/foo.example.com` selects the
	// service from any available namespace while `./foo.example.com` only selects
	// the service from the namespace of the sidecar. If a host is set to `*/*`,
	// Istio will configure the sidecar to be able to reach every service in the
	// mesh that is exported to the sidecar's namespace. The value `~/*` can be used
	// to completely trim the configuration for sidecars that simply receive traffic
	// and respond, but make no outbound connections of their own.
	//
	// NOTE: Only services and configuration artifacts exported to the sidecar's
	// namespace (e.g., `exportTo` value of `*`) can be referenced.
	// Private configurations (e.g., `exportTo` set to `.`) will
	// not be available. Refer to the `exportTo` setting in `VirtualService`,
	// `DestinationRule`, and `ServiceEntry` configurations for details.
	//
	// **WARNING:** The list of egress hosts in a `SidecarSpec` must also include
	// the Mixer control plane services if they are enabled. Envoy will not
	// be able to reach them otherwise. For example, add host
	// `istio-system/istio-telemetry.istio-system.svc.cluster.local` if telemetry
	// is enabled, `istio-system/istio-policy.istio-system.svc.cluster.local` if
	// policy is enabled, or add `istio-system/*` to allow all services in the
	// `istio-system` namespace. This requirement is temporary and will be removed
	// in a future Istio release.
	Hosts []string `json:"hosts"`
}

type IstioIngressListener struct {
	// The port associated with the listener.
	Port *Port `json:"port"`
	// The IP to which the listener should be bound. Must be in the
	// format `x.x.x.x`. Unix domain socket addresses are not allowed in
	// the bind field for ingress listeners. If omitted, Istio will
	// automatically configure the defaults based on imported services
	// and the workload instances to which this configuration is applied
	// to.
	Bind string `json:"bind,omitempty"`
	// The captureMode option dictates how traffic to the listener is
	// expected to be captured (or not).
	CaptureMode CaptureMode `json:"captureMode,omitempty"`
	// The loopback IP endpoint or Unix domain socket to which
	// traffic should be forwarded to. This configuration can be used to
	// redirect traffic arriving at the bind `IP:Port` on the sidecar to a `localhost:port`
	// or Unix domain socket where the application workload instance is listening for
	// connections. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket`
	DefaultEndpoint string `json:"defaultEndpoint"`
}

type L4MatchAttributes struct {
	// IPv4 or IPv6 ip addresses of destination with optional subnet.  E.g.,
	// a.b.c.d/xx form or just a.b.c.d.
	DestinationSubnets []string `json:"destinationSubnets,omitempty"`

	// Specifies the port on the host that is being addressed. Many services
	// only expose a single port or label ports with the protocols they support,
	// in these cases it is not required to explicitly select the port.
	Port *int `json:"port,omitempty"`

	// One or more labels that constrain the applicability of a rule to
	// workloads with the given labels. If the VirtualService has a list of
	// gateways specified at the top, it should include the reserved gateway
	// `mesh` in order for this field to be applicable.
	SourceLabels map[string]string `json:"sourceLabels,omitempty"`

	// Names of gateways where the rule should be applied to. Gateway names
	// at the top of the VirtualService (if any) are overridden. The gateway
	// match is independent of sourceLabels.
	Gateways []string `json:"gateways,omitempty"`
}

type ListenerMatch struct {
	// The service port/gateway port to which traffic is being
	// sent/received. If not specified, matches all listeners. Even though
	// inbound listeners are generated for the instance/pod ports, only
	// service ports should be used to match listeners.
	PortNumber uint32 `json:"portNumber,omitempty"`
	// Instead of using specific port numbers, a set of ports matching
	// a given service's port name can be selected. Matching is case
	// insensitive.
	// Not implemented.
	// $hide_from_docs
	PortName string `json:"portName,omitempty"`
	// Match a specific filter chain in a listener. If specified, the
	// patch will be applied to the filter chain (and a specific
	// filter if specified) and not to other filter chains in the
	// listener.
	FilterChain *FilterChainMatch `json:"filterChain,omitempty"`
	// Match a specific listener by its name. The listeners generated
	// by Pilot are typically named as IP:Port.
	Name string `json:"name,omitempty"`
}

type LoadBalancerSettings struct {

	// Standard load balancing algorithms that require no tuning.
	Simple *SimpleLB `json:"simple,omitempty"`

	// Consistent Hash-based load balancing can be used to provide soft
	// session affinity based on HTTP headers, cookies or other
	// properties. This load balancing policy is applicable only for HTTP
	// connections. The affinity to a particular destination host will be
	// lost when one or more hosts are added/removed from the destination
	// service.
	ConsistentHash *ConsistentHashLB `json:"consistentHash,omitempty"`
}

type OutboundTrafficPolicy struct {
	Mode *OutboundTrafficPolicyMode `json:"mode,omitempty"`
}

type OutboundTrafficPolicyMode string

type OutlierDetection struct {
	// Number of errors before a host is ejected from the connection
	// pool. Defaults to 5. When the upstream host is accessed over HTTP, a
	// 502, 503 or 504 return code qualifies as an error. When the upstream host
	// is accessed over an opaque TCP connection, connect timeouts and
	// connection error/failure events qualify as an error.
	ConsecutiveErrors int32 `json:"consecutiveErrors,omitempty"`

	// Number of gateway errors before a host is ejected from the connection pool.
	// When the upstream host is accessed over HTTP, a 502, 503, or 504 return
	// code qualifies as a gateway error. When the upstream host is accessed over
	// an opaque TCP connection, connect timeouts and connection error/failure
	// events qualify as a gateway error.
	// This feature is disabled by default or when set to the value 0.
	//
	// Note that consecutive_gateway_errors and consecutive_5xx_errors can be
	// used separately or together. Because the errors counted by
	// consecutive_gateway_errors are also included in consecutive_5xx_errors,
	// if the value of consecutive_gateway_errors is greater than or equal to
	// the value of consecutive_5xx_errors, consecutive_gateway_errors will have
	// no effect.
	ConsecutiveGatewayErrors *uint32 `json:"consecutiveGatewayErrors,omitempty"`

	// Number of 5xx errors before a host is ejected from the connection pool.
	// When the upstream host is accessed over an opaque TCP connection, connect
	// timeouts, connection error/failure and request failure events qualify as a
	// 5xx error.
	// This feature defaults to 5 but can be disabled by setting the value to 0.
	//
	// Note that consecutive_gateway_errors and consecutive_5xx_errors can be
	// used separately or together. Because the errors counted by
	// consecutive_gateway_errors are also included in consecutive_5xx_errors,
	// if the value of consecutive_gateway_errors is greater than or equal to
	// the value of consecutive_5xx_errors, consecutive_gateway_errors will have
	// no effect.
	Consecutive5XxErrors *uint32 `json:"consecutive5xxErrors,omitempty"`

	// Time interval between ejection sweep analysis. format:
	// 1h/1m/1s/1ms. MUST BE >=1ms. Default is 10s.
	Interval *string `json:"interval,omitempty"`

	// Minimum ejection duration. A host will remain ejected for a period
	// equal to the product of minimum ejection duration and the number of
	// times the host has been ejected. This technique allows the system to
	// automatically increase the ejection period for unhealthy upstream
	// servers. format: 1h/1m/1s/1ms. MUST BE >=1ms. Default is 30s.
	BaseEjectionTime *string `json:"baseEjectionTime,omitempty"`

	// Maximum % of hosts in the load balancing pool for the upstream
	// service that can be ejected. Defaults to 10%.
	MaxEjectionPercent *int32 `json:"maxEjectionPercent,omitempty"`

	// Outlier detection will be enabled as long as the associated load balancing
	// pool has at least min_health_percent hosts in healthy mode. When the
	// percentage of healthy hosts in the load balancing pool drops below this
	// threshold, outlier detection will be disabled and the proxy will load balance
	// across all hosts in the pool (healthy and unhealthy). The threshold can be
	// disabled by setting it to 0%. The default is 0% as it's not typically
	// applicable in k8s environments with few pods per service.
	MinHealthPercent *int32 `json:"minHealthPercent,omitempty"`
}

type Patch struct {
	// Determines how the patch should be applied.
	Operation PatchOperation `json:"operation,omitempty"`
	// The JSON config of the object being patched. This will be merged using
	// json merge semantics with the existing proto in the path.
	Value json.RawMessage `json:"value,omitempty"`
}

type PatchContext string

type PatchOperation string

type Percentage struct {
	Value float32 `json:"value"`
}

type Port struct {
	// REQUIRED: A valid non-negative integer port number.
	Number int `json:"number"`

	// REQUIRED: The protocol exposed on the port.
	// MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.
	// TLS implies the connection will be routed based on the SNI header to
	// the destination without terminating the TLS connection.
	Protocol PortProtocol `json:"protocol"`

	// Label assigned to the port.
	Name string `json:"name,omitempty"`
}

type PortProtocol string

type PortSelector struct {
	// Valid port number
	Number uint32 `json:"number"`
}

type PortTrafficPolicy struct {
	TrafficPolicyCommon `json:",inline"`

	// Specifies the port name or number of a port on the destination service
	// on which this policy is being applied.
	Port *PortSelector `json:"port,omitempty"`
}

type ProxyMatch struct {
	// A regular expression in golang regex format (RE2) that can be
	// used to select proxies using a specific version of istio
	// proxy. The Istio version for a given proxy is obtained from the
	// node metadata field ISTIO_VERSION supplied by the proxy when
	// connecting to Pilot. This value is embedded as an environment
	// variable (ISTIO_META_ISTIO_VERSION) in the Istio proxy docker
	// image. Custom proxy implementations should provide this metadata
	// variable to take advantage of the Istio version check option.
	ProxyVersion string `json:"proxyVersion,omitempty"`
	// Match on the node metadata supplied by a proxy when connecting
	// to Istio Pilot. Note that while Envoy's node metadata is of
	// type Struct, only string key-value pairs are processed by
	// Pilot. All keys specified in the metadata must match with exact
	// values. The match will fail if any of the specified keys are
	// absent or the values fail to match.
	Metadata map[string]string `json:"metadata,omitempty"`
}

type ReadinessProbe struct {
	// Number of seconds after the container has started before readiness probes are initiated.
	InitialDelaySeconds int32 `json:"initialDelaySeconds,omitempty"`
	// Number of seconds after which the probe times out.
	// Defaults to 1 second. Minimum value is 1 second.
	TimeoutSeconds int32 `json:"timeoutSeconds,omitempty"`
	// How often (in seconds) to perform the probe.
	// Default to 10 seconds. Minimum value is 1 second.
	PeriodSeconds int32 `json:"periodSeconds,omitempty"`
	// Minimum consecutive successes for the probe to be considered successful after having failed.
	// Defaults to 1 second.
	SuccessThreshold int32 `json:"successThreshold,omitempty"`
	// Minimum consecutive failures for the probe to be considered failed after having succeeded.
	// Defaults to 3 seconds.
	FailureThreshold int32 `json:"failureThreshold,omitempty"`

	// Users can only provide one configuration for health-checks (tcp, http, exec),
	// and this is expressed as a one-of. All the other configuration values
	// hold true for any of the health-check methods.
	HTTPGet   *HTTPHealthCheckConfig `json:"httpGet,omitempty"`
	TCPSocket *TCPHealthCheckConfig  `json:"tcpSocket,omitempty"`
	Exec      *ExecHealthCheckConfig `json:"exec,omitempty"`
}

type RouteConfigurationMatch struct {
	// The service port number or gateway server port number for which
	// this route configuration was generated. If omitted, applies to
	// route configurations for all ports.
	PortNumber uint32 `json:"portNumber,omitempty"`
	// Applicable only for GATEWAY context. The gateway server port
	// name for which this route configuration was generated.
	PortName string `json:"portName,omitempty"`
	// The Istio gateway config's namespace/name for which this route
	// configuration was generated. Applies only if the context is
	// GATEWAY. Should be in the namespace/name format. Use this field
	// in conjunction with the portNumber and portName to accurately
	// select the Envoy route configuration for a specific HTTPS
	// server within a gateway config object.
	Gateway string `json:"gateway,omitempty"`
	// Match a specific virtual host in a route configuration and
	// apply the patch to the virtual host.
	Vhost *VirtualHostMatch `json:"vhost,omitempty"`
	// Route configuration name to match on. Can be used to match a
	// specific route configuration by name, such as the internally
	// generated "http_proxy" route configuration for all sidecars.
	Name string `json:"name,omitempty"`
}

type RouteDestination struct {
	// REQUIRED. Destination uniquely identifies the instances of a service
	// to which the request/connection should be forwarded to.
	Destination *Destination `json:"destination"`

	// REQUIRED. The proportion of traffic to be forwarded to the service
	// version. (0-100). Sum of weights across destinations SHOULD BE == 100.
	// If there is only one destination in a rule, the weight value is assumed to
	// be 100.
	Weight *int `json:"weight,omitempty"`
}

type RouteMatch struct {
	// The Route objects generated by default are named as
	// "default".  Route objects generated using a virtual service
	// will carry the name used in the virtual service's HTTP
	// routes.
	Name string `json:"name,omitempty"`
	// Match a route with specific action type.
	Action *RouteMatchAction `json:"action,omitempty"`
}

type RouteMatchAction string

type Server struct {
	// REQUIRED: The Port on which the proxy should listen for incoming
	// connections.
	Port *Port `json:"port"`

	// REQUIRED. One or more hosts exposed by this gateway.
	// While typically applicable to
	// HTTP services, it can also be used for TCP services using TLS with SNI.
	// A host is specified as a `dnsName` with an optional `namespace/` prefix.
	// The `dnsName` should be specified using FQDN format, optionally including
	// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
	// Set the `dnsName` to `*` to select all `VirtualService` hosts from the
	// specified namespace (e.g.,`prod/*`).
	//
	// The `namespace` can be set to `*` or `.`, representing any or the current
	// namespace, respectively. For example, `*/foo.example.com` selects the
	// service from any available namespace while `./foo.example.com` only selects
	// the service from the namespace of the sidecar. The default, if no `namespace/`
	// is specified, is `*/`, that is, select services from any namespace.
	// Any associated `DestinationRule` in the selected namespace will also be used.
	//
	// A `VirtualService` must be bound to the gateway and must have one or
	// more hosts that match the hosts specified in a server. The match
	// could be an exact match or a suffix match with the server's hosts. For
	// example, if the server's hosts specifies `*.example.com`, a
	// `VirtualService` with hosts `dev.example.com` or `prod.example.com` will
	// match. However, a `VirtualService` with host `example.com` or
	// `newexample.com` will not match.
	//
	// NOTE: Only virtual services exported to the gateway's namespace
	// (e.g., `exportTo` value of `*`) can be referenced.
	// Private configurations (e.g., `exportTo` set to `.`) will not be
	// available. Refer to the `exportTo` setting in `VirtualService`,
	// `DestinationRule`, and `ServiceEntry` configurations for details.
	Hosts []string `json:"hosts,omitempty"`

	// Set of TLS related options that govern the server's behavior. Use
	// these options to control if all http requests should be redirected to
	// https, and the TLS modes to use.
	TLS *TLSOptions `json:"tls,omitempty"`

	// The loopback IP endpoint or Unix domain socket to which traffic should
	// be forwarded to by default. Format should be `127.0.0.1:PORT` or
	// `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace).
	DefaultEndpoint *string `json:"defaultEndpoint,omitempty"`
}

type ServiceEntry struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ServiceEntrySpec `json:"spec"`
}

type ServiceEntryEndpoint struct {
	// REQUIRED: Address associated with the network endpoint without the
	// port.  Domain names can be used if and only if the resolution is set
	// to DNS, and must be fully-qualified without wildcards. Use the form
	// unix:///absolute/path/to/socket for Unix domain socket endpoints.
	Address *string `json:"address,omitempty"`

	// Set of ports associated with the endpoint. The ports must be
	// associated with a port name that was declared as part of the
	// service. Do not use for `unix://` addresses.
	Ports map[string]uint32 `json:"ports,omitempty"`

	// One or more labels associated with the endpoint.
	Labels map[string]string `json:"labels,omitempty"`

	// Network enables Istio to group endpoints resident in the same L3
	// domain/network. All endpoints in the same network are assumed to be
	// directly reachable from one another. When endpoints in different
	// networks cannot reach each other directly, an Istio Gateway can be
	// used to establish connectivity (usually using the
	// AUTO_PASSTHROUGH mode in a Gateway Server). This is
	// an advanced configuration used typically for spanning an Istio mesh
	// over multiple clusters.
	Network *string `json:"network,omitempty"`

	// The locality associated with the endpoint. A locality corresponds
	// to a failure domain (e.g., country/region/zone). Arbitrary failure
	// domain hierarchies can be represented by separating each
	// encapsulating failure domain by /. For example, the locality of an
	// an endpoint in US, in US-East-1 region, within availability zone
	// az-1, in data center rack r11 can be represented as
	// us/us-east-1/az-1/r11. Istio will configure the sidecar to route to
	// endpoints within the same locality as the sidecar. If none of the
	// endpoints in the locality are available, endpoints parent locality
	// (but within the same network ID) will be chosen. For example, if
	// there are two endpoints in same network (networkID "n1"), say e1
	// with locality us/us-east-1/az-1/r11 and e2 with locality
	// us/us-east-1/az-2/r12, a sidecar from us/us-east-1/az-1/r11 locality
	// will prefer e1 from the same locality over e2 from a different
	// locality. Endpoint e2 could be the IP associated with a gateway
	// (that bridges networks n1 and n2), or the IP associated with a
	// standard service endpoint.
	Locality *string `json:"locality,omitempty"`

	// The load balancing weight associated with the endpoint. Endpoints
	// with higher weights will receive proportionally higher traffic.
	Weight *uint32 `json:"weight,omitempty"`
}

type ServiceEntryList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []ServiceEntry `json:"items"`
}

type ServiceEntryLocation string

type ServiceEntryResolution string

type ServiceEntrySpec struct {
	// REQUIRED. The hosts associated with the ServiceEntry. Could be a DNS
	// name with wildcard prefix.
	//
	// 1. The hosts field is used to select matching hosts in VirtualServices and DestinationRules.
	// 2. For HTTP traffic the HTTP Host/Authority header will be matched against the hosts field.
	// 3. For HTTPs or TLS traffic containing Server Name Indication (SNI), the SNI value
	// will be matched against the hosts field.
	//
	// Note that when resolution is set to type DNS
	// and no endpoints are specified, the host field will be used as the DNS name
	// of the endpoint to route traffic to.
	Hosts []string `json:"hosts,omitempty"`

	// The virtual IP addresses associated with the service. Could be CIDR
	// prefix. For HTTP traffic, generated route configurations will include http route
	// domains for both the `addresses` and `hosts` field values and the destination will
	// be identified based on the HTTP Host/Authority header.
	// If one or more IP addresses are specified,
	// the incoming traffic will be identified as belonging to this service
	// if the destination IP matches the IP/CIDRs specified in the addresses
	// field. If the Addresses field is empty, traffic will be identified
	// solely based on the destination port. In such scenarios, the port on
	// which the service is being accessed must not be shared by any other
	// service in the mesh. In other words, the sidecar will behave as a
	// simple TCP proxy, forwarding incoming traffic on a specified port to
	// the specified destination endpoint IP/host. Unix domain socket
	// addresses are not supported in this field.
	Addresses []string `json:"addresses,omitempty"`

	// REQUIRED. The ports associated with the external service. If the
	// Endpoints are Unix domain socket addresses, there must be exactly one
	// port.
	Ports []*Port `json:"ports,omitempty"`

	// Specify whether the service should be considered external to the mesh
	// or part of the mesh.
	Location *ServiceEntryLocation `json:"location,omitempty"`

	// REQUIRED: Service discovery mode for the hosts. Care must be taken
	// when setting the resolution mode to NONE for a TCP port without
	// accompanying IP addresses. In such cases, traffic to any IP on
	// said port will be allowed (i.e. 0.0.0.0:<port>).
	Resolution *ServiceEntryResolution `json:"resolution,omitempty"`

	// One or more endpoints associated with the service.
	Endpoints []*ServiceEntryEndpoint `json:"endpoints,omitempty"`

	// A list of namespaces to which this service is exported. Exporting a service
	// allows it to be used by sidecars, gateways and virtual services defined in
	// other namespaces. This feature provides a mechanism for service owners
	// and mesh administrators to control the visibility of services across
	// namespace boundaries.
	//
	// If no namespaces are specified then the service is exported to all
	// namespaces by default.
	//
	// The value "." is reserved and defines an export to the same namespace that
	// the service is declared in. Similarly the value "*" is reserved and
	// defines an export to all namespaces.
	//
	// For a Kubernetes Service, the equivalent effect can be achieved by setting
	// the annotation "networking.istio.io/exportTo" to a comma-separated list
	// of namespace names.
	//
	// NOTE: in the current release, the `exportTo` value is restricted to
	// "." or "*" (i.e., the current namespace or all namespaces).
	ExportTo []string `json:"exportTo,omitempty"`

	// The list of subject alternate names allowed for workload instances that
	// implement this service. This information is used to enforce
	// [secure-naming](https://istio.io/docs/concepts/security/#secure-naming).
	// If specified, the proxy will verify that the server
	// certificate's subject alternate name matches one of the specified values.
	SubjectAltNames []string `json:"subjectAltNames,omitempty"`
}

type Sidecar struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec SidecarSpec `json:"spec"`
}

type SidecarList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []Sidecar `json:"items"`
}

type SidecarSpec struct {
	// Criteria used to select the specific set of pods/VMs on which this
	// `SidecarSpec` configuration should be applied. If omitted, the `SidecarSpec`
	// configuration will be applied to all workload instances in the same namespace.
	WorkloadSelector *WorkloadSelector `json:"workloadSelector,omitempty"`
	// Ingress specifies the configuration of the sidecar for processing
	// inbound traffic to the attached workload instance. If omitted, Istio will
	// automatically configure the sidecar based on the information about the workload
	// obtained from the orchestration platform (e.g., exposed ports, services,
	// etc.). If specified, inbound ports are configured if and only if the
	// workload instance is associated with a service.
	Ingress []*IstioIngressListener `json:"ingress,omitempty"`
	// Egress specifies the configuration of the sidecar for processing
	// outbound traffic from the attached workload instance to other services in the
	// mesh.
	Egress []*IstioEgressListener `json:"egress"`
	// This allows to configure the outbound traffic policy.
	// If your application uses one or more external
	// services that are not known apriori, setting the policy to `ALLOW_ANY`
	// will cause the sidecars to route any unknown traffic originating from
	// the application to its requested destination.
	OutboundTrafficPolicy *OutboundTrafficPolicy `json:"outboundTrafficPolicy,omitempty"`
}

type SimpleLB string

type SubFilterMatch struct {
	// The filter name to match on.
	Name string `json:"name,omitempty"`
}

type Subset struct {
	// REQUIRED. Name of the subset. The service name and the subset name can
	// be used for traffic splitting in a route rule.
	Name string `json:"name"`

	// Labels apply a filter over the endpoints of a service in the
	// service registry. See route rules for examples of usage.
	Labels map[string]string `json:"labels"`

	// Traffic policies that apply to this subset. Subsets inherit the
	// traffic policies specified at the DestinationRule level. Settings
	// specified at the subset level will override the corresponding settings
	// specified at the DestinationRule level.
	TrafficPolicy *TrafficPolicy `json:"trafficPolicy,omitempty"`
}

type TCPHealthCheckConfig struct {
	// Host to connect to, defaults to localhost.
	Host string `json:"host,omitempty"`
	// REQUIRED. Port of host.
	Port uint32 `json:"port"`
}

type TCPKeepalive struct {
	// Maximum number of keepalive probes to send without response before
	// deciding the connection is dead. Default is to use the OS level configuration
	// (unless overridden, Linux defaults to 9.)
	Probes *uint32 `json:"probes,omitempty"`
	// The time duration a connection needs to be idle before keep-alive
	// probes start being sent. Default is to use the OS level configuration
	// (unless overridden, Linux defaults to 7200s (ie 2 hours.)
	Time *string `json:"time,omitempty"`
	// The time duration between keep-alive probes.
	// Default is to use the OS level configuration
	// (unless overridden, Linux defaults to 75s.)
	Interval *string `json:"interval,omitempty"`
}

type TCPRoute struct {
	// Match conditions to be satisfied for the rule to be
	// activated. All conditions inside a single match block have AND
	// semantics, while the list of match blocks have OR semantics. The rule
	// is matched if any one of the match blocks succeed.
	Match []L4MatchAttributes `json:"match"`

	// The destination to which the connection should be forwarded to.
	Route []*RouteDestination `json:"route"`
}

type TCPSettings struct {
	// Maximum number of HTTP1 /TCP connections to a destination host.
	MaxConnections *int32 `json:"maxConnections,omitempty"`

	// TCP connection timeout.
	ConnectTimeout *string `json:"connectTimeout,omitempty"`

	// If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty"`
}

type TLSMatchAttributes struct {
	// REQUIRED. SNI (server name indicator) to match on. Wildcard prefixes
	// can be used in the SNI value, e.g., *.com will match foo.example.com
	// as well as example.com. An SNI value must be a subset (i.e., fall
	// within the domain) of the corresponding virtual serivce's hosts.
	SniHosts []string `json:"sniHosts"`

	// IPv4 or IPv6 ip addresses of destination with optional subnet.  E.g.,
	// a.b.c.d/xx form or just a.b.c.d.
	DestinationSubnets []string `json:"destinationSubnets,omitempty"`

	// Specifies the port on the host that is being addressed. Many services
	// only expose a single port or label ports with the protocols they support,
	// in these cases it is not required to explicitly select the port.
	Port *int `json:"port,omitempty"`

	// One or more labels that constrain the applicability of a rule to
	// workloads with the given labels. If the VirtualService has a list of
	// gateways specified at the top, it should include the reserved gateway
	// `mesh` in order for this field to be applicable.
	SourceLabels map[string]string `json:"sourceLabels,omitempty"`

	// Names of gateways where the rule should be applied to. Gateway names
	// at the top of the VirtualService (if any) are overridden. The gateway
	// match is independent of sourceLabels.
	Gateways []string `json:"gateways,omitempty"`
}

type TLSMode string

type TLSOptions struct {
	// If set to true, the load balancer will send a 301 redirect for all
	// http connections, asking the clients to use HTTPS.
	HTTPSRedirect *bool `json:"httpsRedirect,omitempty"`

	// Optional: Indicates whether connections to this port should be
	// secured using TLS. The value of this field determines how TLS is
	// enforced.
	Mode TLSMode `json:"mode,omitempty"`

	// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
	// holding the server-side TLS certificate to use.
	ServerCertificate *string `json:"serverCertificate,omitempty"`

	// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
	// holding the server's private key.
	PrivateKey *string `json:"privateKey,omitempty"`

	// REQUIRED if mode is `MUTUAL`. The path to a file containing
	// certificate authority certificates to use in verifying a presented
	// client side certificate.
	CaCertificates *string `json:"caCertificates,omitempty"`

	// The credentialName stands for a unique identifier that can be used
	// to identify the serverCertificate and the privateKey. The
	// credentialName appended with suffix "-cacert" is used to identify
	// the CaCertificates associated with this server. Gateway workloads
	// capable of fetching credentials from a remote credential store such
	// as Kubernetes secrets, will be configured to retrieve the
	// serverCertificate and the privateKey using credentialName, instead
	// of using the file system paths specified above. If using mutual TLS,
	// gateway workload instances will retrieve the CaCertificates using
	// credentialName-cacert. The semantics of the name are platform
	// dependent.  In Kubernetes, the default Istio supplied credential
	// server expects the credentialName to match the name of the
	// Kubernetes secret that holds the server certificate, the private
	// key, and the CA certificate (if using mutual TLS). Set the
	// `ISTIO_META_USER_SDS` metadata variable in the gateway's proxy to
	// enable the dynamic credential fetching feature.
	CredentialName *string `json:"credentialName,omitempty"`

	// A list of alternate names to verify the subject identity in the
	// certificate presented by the client.
	SubjectAltNames []string `json:"subjectAltNames,omitempty"`

	// An optional list of base64-encoded SHA-256 hashes of the SKPIs of
	// authorized client certificates.
	// Note: When both verify_certificate_hash and verify_certificate_spki
	// are specified, a hash matching either value will result in the
	// certificate being accepted.
	VerifyCertificateSpki []string `json:"verifyCertificateSpki,omitempty"`

	// An optional list of hex-encoded SHA-256 hashes of the
	// authorized client certificates. Both simple and colon separated
	// formats are acceptable.
	// Note: When both verify_certificate_hash and verify_certificate_spki
	// are specified, a hash matching either value will result in the
	// certificate being accepted.
	VerifyCertificateHash []string `json:"verifyCertificateHash,omitempty"`

	// Optional: Minimum TLS protocol version.
	MinProtocolVersion *TLSProtocol `json:"minProtocolVersion,omitempty"`

	// Optional: Maximum TLS protocol version.
	MaxProtocolVersion *TLSProtocol `json:"maxProtocolVersion,omitempty"`

	// Optional: If specified, only support the specified cipher list.
	// Otherwise default to the default cipher list supported by Envoy.
	CipherSuites []string `json:"cipherSuites,omitempty"`
}

type TLSProtocol string

type TLSRoute struct {
	// REQUIRED. Match conditions to be satisfied for the rule to be
	// activated. All conditions inside a single match block have AND
	// semantics, while the list of match blocks have OR semantics. The rule
	// is matched if any one of the match blocks succeed.
	Match []TLSMatchAttributes `json:"match"`

	// The destination to which the connection should be forwarded to.
	Route []*RouteDestination `json:"route"`
}

type TLSSettings struct {
	// REQUIRED: Indicates whether connections to this port should be secured
	// using TLS. The value of this field determines how TLS is enforced.
	Mode TLSmode `json:"mode"`

	// REQUIRED if mode is `MUTUAL`. The path to the file holding the
	// client-side TLS certificate to use.
	// Should be empty if mode is `ISTIO_MUTUAL`.
	ClientCertificate *string `json:"clientCertificate,omitempty"`

	// REQUIRED if mode is `MUTUAL`. The path to the file holding the
	// client's private key.
	// Should be empty if mode is `ISTIO_MUTUAL`.
	PrivateKey *string `json:"privateKey,omitempty"`

	// OPTIONAL: The path to the file containing certificate authority
	// certificates to use in verifying a presented server certificate. If
	// omitted, the proxy will not verify the server's certificate.
	// Should be empty if mode is `ISTIO_MUTUAL`.
	CaCertificates *string `json:"caCertificates,omitempty"`

	// A list of alternate names to verify the subject identity in the
	// certificate. If specified, the proxy will verify that the server
	// certificate's subject alt name matches one of the specified values.
	// If specified, this list overrides the value of subject_alt_names
	// from the ServiceEntry.
	SubjectAltNames []string `json:"subjectAltNames,omitempty"`

	// SNI string to present to the server during TLS handshake.
	SNI *string `json:"sni,omitempty"`
}

type TLSmode string

type TrafficPolicy struct {
	TrafficPolicyCommon `json:",inline"`

	// Traffic policies specific to individual ports. Note that port level
	// settings will override the destination-level settings. Traffic
	// settings specified at the destination-level will not be inherited when
	// overridden by port-level settings, i.e. default values will be applied
	// to fields omitted in port-level traffic policies.
	PortLevelSettings []PortTrafficPolicy `json:"portLevelSettings,omitempty"`
}

type TrafficPolicyCommon struct {
	// Settings controlling the load balancer algorithms.
	LoadBalancer *LoadBalancerSettings `json:"loadBalancer,omitempty"`

	// Settings controlling the volume of connections to an upstream service.
	ConnectionPool *ConnectionPoolSettings `json:"connectionPool,omitempty"`

	// Settings controlling eviction of unhealthy hosts from the load balancing pool.
	OutlierDetection *OutlierDetection `json:"outlierDetection,omitempty"`

	// TLS related settings for connections to the upstream service.
	TLS *TLSSettings `json:"tls,omitempty"`
}

type VirtualHostMatch struct {
	// The VirtualHosts objects generated by Istio are named as
	// host:port, where the host typically corresponds to the
	// VirtualService's host field or the hostname of a service in the
	// registry.
	Name string `json:"name,omitempty"`
	// Match a specific route within the virtual host.
	Route *RouteMatch `json:"route,omitempty"`
}

type VirtualService struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec VirtualServiceSpec `json:"spec"`
}

type VirtualServiceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`

	Items []VirtualService `json:"items"`
}

type VirtualServiceSpec struct {
	// REQUIRED. The destination hosts to which traffic is being sent. Could
	// be a DNS name with wildcard prefix or an IP address.  Depending on the
	// platform, short-names can also be used instead of a FQDN (i.e. has no
	// dots in the name). In such a scenario, the FQDN of the host would be
	// derived based on the underlying platform.
	//
	// A single VirtualService can be used to describe all the traffic
	// properties of the corresponding hosts, including those for multiple
	// HTTP and TCP ports. Alternatively, the traffic properties of a host
	// can be defined using more than one VirtualService, with certain
	// caveats. Refer to the
	// [Operations Guide](https://istio.io/docs/ops/traffic-management/deploy-guidelines/#multiple-virtual-services-and-destination-rules-for-the-same-host)
	// for details.
	//
	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
	// the short name based on the namespace of the rule, not the service. A
	// rule in the "default" namespace containing a host "reviews" will be
	// interpreted as "reviews.default.svc.cluster.local", irrespective of
	// the actual namespace associated with the reviews service. _To avoid
	// potential misconfigurations, it is recommended to always use fully
	// qualified domain names over short names._
	//
	// The hosts field applies to both HTTP and TCP services. Service inside
	// the mesh, i.e., those found in the service registry, must always be
	// referred to using their alphanumeric names. IP addresses are allowed
	// only for services defined via the Gateway.
	Hosts []string `json:"hosts"`

	// The names of gateways and sidecars that should apply these routes. A
	// single VirtualService is used for sidecars inside the mesh as well as
	// for one or more gateways. The selection condition imposed by this
	// field can be overridden using the source field in the match conditions
	// of protocol-specific routes. The reserved word `mesh` is used to imply
	// all the sidecars in the mesh. When this field is omitted, the default
	// gateway (`mesh`) will be used, which would apply the rule to all
	// sidecars in the mesh. If a list of gateway names is provided, the
	// rules will apply only to the gateways. To apply the rules to both
	// gateways and sidecars, specify `mesh` as one of the gateway names.
	Gateways []string `json:"gateways,omitempty"`

	// An ordered list of route rules for HTTP traffic. HTTP routes will be
	// applied to platform service ports named 'http-*'/'http2-*'/'grpc-*', gateway
	// ports with protocol HTTP/HTTP2/GRPC/ TLS-terminated-HTTPS and service
	// entry ports using HTTP/HTTP2/GRPC protocols.  The first rule matching
	// an incoming request is used.
	HTTP []HTTPRoute `json:"http,omitempty"`

	// An ordered list of route rule for non-terminated TLS & HTTPS
	// traffic. Routing is typically performed using the SNI value presented
	// by the ClientHello message. TLS routes will be applied to platform
	// service ports named 'https-*', 'tls-*', unterminated gateway ports using
	// HTTPS/TLS protocols (i.e. with "passthrough" TLS mode) and service
	// entry ports using HTTPS/TLS protocols.  The first rule matching an
	// incoming request is used.  NOTE: Traffic 'https-*' or 'tls-*' ports
	// without associated virtual service will be treated as opaque TCP
	// traffic.
	TLS []TLSRoute `json:"tls,omitempty"`

	// An ordered list of route rules for opaque TCP traffic. TCP routes will
	// be applied to any port that is not a HTTP or TLS port. The first rule
	// matching an incoming request is used.
	TCP []TCPRoute `json:"tcp,omitempty"`

	// A list of namespaces to which this virtual service is exported. Exporting a
	// virtual service allows it to be used by sidecars and gateways defined in
	// other namespaces. This feature provides a mechanism for service owners
	// and mesh administrators to control the visibility of virtual services
	// across namespace boundaries.
	//
	// If no namespaces are specified then the virtual service is exported to all
	// namespaces by default.
	//
	// The value "." is reserved and defines an export to the same namespace that
	// the virtual service is declared in. Similarly the value "*" is reserved and
	// defines an export to all namespaces.
	//
	// NOTE: in the current release, the `exportTo` value is restricted to
	// "." or "*" (i.e., the current namespace or all namespaces).
	ExportTo []string `json:"exportTo,omitempty"`
}

type WorkloadEntry struct {
	v1.TypeMeta   `json:",inline"`
	v1.ObjectMeta `json:"metadata,omitempty"`

	// Spec defines the implementation of this definition.
	Spec   WorkloadEntrySpec    `json:"spec"`
	Status istioApi.IstioStatus `json:"status"`
}

type WorkloadEntryList struct {
	v1.TypeMeta `json:",inline"`
	v1.ListMeta `json:"metadata"`
	Items       []WorkloadEntry `json:"items"`
}

type WorkloadEntrySpec struct {
	// Address associated with the network endpoint without the
	// port.  Domain names can be used if and only if the resolution is set
	// to DNS, and must be fully-qualified without wildcards. Use the form
	// unix:///absolute/path/to/socket for Unix domain socket endpoints.
	Address string `json:"address"`
	// Set of ports associated with the endpoint. The ports must be
	// associated with a port name that was declared as part of the
	// service. Do not use for `unix://` addresses.
	Ports map[string]uint32 `json:"ports,omitempty"`
	// One or more labels associated with the endpoint.
	Labels map[string]string `json:"labels,omitempty"`
	// Network enables Istio to group endpoints resident in the same L3
	// domain/network. All endpoints in the same network are assumed to be
	// directly reachable from one another. When endpoints in different
	// networks cannot reach each other directly, an Istio Gateway can be
	// used to establish connectivity (usually using the
	// `AUTO_PASSTHROUGH` mode in a Gateway Server). This is
	// an advanced configuration used typically for spanning an Istio mesh
	// over multiple clusters.
	Network string `json:"network,omitempty"`
	// The locality associated with the endpoint. A locality corresponds
	// to a failure domain (e.g., country/region/zone). Arbitrary failure
	// domain hierarchies can be represented by separating each
	// encapsulating failure domain by /. For example, the locality of an
	// an endpoint in US, in US-East-1 region, within availability zone
	// az-1, in data center rack r11 can be represented as
	// us/us-east-1/az-1/r11. Istio will configure the sidecar to route to
	// endpoints within the same locality as the sidecar. If none of the
	// endpoints in the locality are available, endpoints parent locality
	// (but within the same network ID) will be chosen. For example, if
	// there are two endpoints in same network (networkID "n1"), say e1
	// with locality us/us-east-1/az-1/r11 and e2 with locality
	// us/us-east-1/az-2/r12, a sidecar from us/us-east-1/az-1/r11 locality
	// will prefer e1 from the same locality over e2 from a different
	// locality. Endpoint e2 could be the IP associated with a gateway
	// (that bridges networks n1 and n2), or the IP associated with a
	// standard service endpoint.
	Locality string `json:"locality,omitempty"`
	// The load balancing weight associated with the endpoint. Endpoints
	// with higher weights will receive proportionally higher traffic.
	Weight uint32 `json:"weight,omitempty"`
	// The service account associated with the workload if a sidecar
	// is present in the workload. The service account must be present
	// in the same namespace as the configuration ( WorkloadEntry or a
	// ServiceEntry)
	ServiceAccount string `json:"serviceAccount,omitempty"`
}

type WorkloadGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              WorkloadGroupSpec    `json:"spec"`
	Status            istioApi.IstioStatus `json:"status"`
}

type WorkloadGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []WorkloadGroup `json:"items"`
}

type WorkloadGroupObjectMeta struct {
	// Labels to attach.
	Labels map[string]string `json:"labels,omitempty"`
	// Annotations to attach.
	Annotations map[string]string `json:"annotations,omitempty"`
}

type WorkloadGroupSpec struct {
	// Metadata that will be used for all corresponding `WorkloadEntries`.
	// User labels for a workload group should be set here in `metadata` rather than in `template`.
	Metadata *WorkloadGroupObjectMeta `json:"metadata,omitempty"`
	// REQUIRED. Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`.
	// Please note that `address` and `labels` fields should not be set in the template, and an empty `serviceAccount`
	// should default to `default`. The workload identities (mTLS certificates) will be bootstrapped using the
	// specified service account's token. Workload entries in this group will be in the same namespace as the
	// workload group, and inherit the labels and annotations from the above `metadata` field.
	Template *WorkloadEntrySpec `json:"template"`
	// `ReadinessProbe` describes the configuration the user must provide for health-checking on their workload.
	// This configuration mirrors K8S in both syntax and logic for the most part.
	Probe *ReadinessProbe `json:"probe,omitempty"`
}

type WorkloadSelector struct {
	// One or more labels that indicate a specific set of pods/VMs
	// on which this `SidecarSpec` configuration should be applied. The scope of
	// label search is restricted to the configuration namespace in which the
	// the resource is present.
	Labels map[string]string `json:"labels"`
}