xds

type Address struct {

	// Types that are assignable to Address:
	//
	//	*Address_SocketAddress
	//	*Address_Pipe
	Address isAddress_Address `protobuf_oneof:"address"`
	// contains filtered or unexported fields
}

type Address_Pipe struct {
	Pipe *Pipe `protobuf:"bytes,2,opt,name=pipe,proto3,oneof"`
}

type Address_SocketAddress struct {
	SocketAddress *SocketAddress `protobuf:"bytes,1,opt,name=socket_address,json=socketAddress,proto3,oneof"`
}

type AggregatedConfigSource struct {
	// contains filtered or unexported fields
}

type Any struct {

	// A URL/resource name whose content describes the type of the
	// serialized protocol buffer message.
	//
	// For URLs which use the scheme `http`, `https`, or no scheme, the
	// following restrictions and interpretations apply:
	//
	//   - If no scheme is provided, `https` is assumed.
	//   - The last segment of the URL's path must represent the fully
	//     qualified name of the type (as in `path/google.protobuf.Duration`).
	//     The name should be in a canonical form (e.g., leading "." is
	//     not accepted).
	//   - An HTTP GET on the URL must yield a [google.protobuf.Type][]
	//     value in binary format, or produce an error.
	//   - Applications are allowed to cache lookup results based on the
	//     URL, or have them precompiled into a binary to avoid any
	//     lookup. Therefore, binary compatibility needs to be preserved
	//     on changes to types. (Use versioned type names to manage
	//     breaking changes.)
	//
	// Schemes other than `http`, `https` (or the empty scheme) might be
	// used with implementation specific semantics.
	TypeUrl string `protobuf:"bytes,1,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
	// Must be a valid serialized protocol buffer of the above specified type.
	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type AuthCondition struct {
	Invert bool   `protobuf:"varint,1,opt,name=invert,proto3" json:"invert,omitempty"`
	Port   uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type AuthRule struct {
	Invert bool `protobuf:"varint,1,opt,name=invert,proto3" json:"invert,omitempty"`
	// Rules
	Identity  string `protobuf:"bytes,2,opt,name=identity,proto3" json:"identity,omitempty"`
	Namespace string `protobuf:"bytes,3,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// contains filtered or unexported fields
}

type Authorization struct {

	// If true, mTLS will be required
	EnforceMTLS bool `protobuf:"varint,1,opt,name=enforceMTLS,proto3" json:"enforceMTLS,omitempty"`
	// Allow policies
	Allow []*Policy `protobuf:"bytes,2,rep,name=allow,proto3" json:"allow,omitempty"`
	// Deny policies
	Deny []*Policy `protobuf:"bytes,3,rep,name=deny,proto3" json:"deny,omitempty"`
	// contains filtered or unexported fields
}

type BindConfig struct {

	// The address to bind to when creating a socket.
	SourceAddress *SocketAddress `protobuf:"bytes,1,opt,name=source_address,json=sourceAddress,proto3" json:"source_address,omitempty"`
	// contains filtered or unexported fields
}

type BoolValue struct {

	// The bool value.
	Value bool `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type CertificateValidationContext struct {

	// TLS certificate data containing certificate authority certificates to use in verifying
	// a presented peer certificate (e.g. server certificate for clusters or client certificate
	// for listeners). If not specified and a peer certificate is presented it will not be
	// verified. By default, a client certificate is optional, unless one of the additional
	// options (:ref:`require_client_certificate
	// <envoy_api_field_auth.DownstreamTlsContext.require_client_certificate>`,
	// :ref:`verify_certificate_hash
	// <envoy_api_field_auth.CertificateValidationContext.verify_certificate_hash>`, or
	// :ref:`verify_subject_alt_name
	// <envoy_api_field_auth.CertificateValidationContext.verify_subject_alt_name>`) is also
	// specified.
	//
	// See :ref:`the TLS overview <arch_overview_ssl_enabling_verification>` for a list of common
	// system CA locations.
	TrustedCa *DataSource `protobuf:"bytes,1,opt,name=trusted_ca,json=trustedCa,proto3" json:"trusted_ca,omitempty"`
	// If specified, Envoy will verify (pin) the hex-encoded SHA-256 hash of
	// the presented certificate.
	VerifyCertificateHash []string `` /* 126-byte string literal not displayed */
	// If specified, Envoy will verify (pin) base64-encoded SHA-256 hash of
	// the Subject Public Key Information (SPKI) of the presented certificate.
	// This is the same format as used in HTTP Public Key Pinning.
	// [#not-implemented-hide:]
	VerifySpkiSha256 []string `protobuf:"bytes,3,rep,name=verify_spki_sha256,json=verifySpkiSha256,proto3" json:"verify_spki_sha256,omitempty"`
	// An optional list of subject alternative names. If specified, Envoy will verify that
	// the certificate’s subject alternative name matches one of the specified values.
	VerifySubjectAltName []string `protobuf:"bytes,4,rep,name=verify_subject_alt_name,json=verifySubjectAltName,proto3" json:"verify_subject_alt_name,omitempty"`
	// [#not-implemented-hide:] Must present a signed time-stamped OCSP response.
	RequireOcspStaple *BoolValue `protobuf:"bytes,5,opt,name=require_ocsp_staple,json=requireOcspStaple,proto3" json:"require_ocsp_staple,omitempty"`
	// [#not-implemented-hide:] Must present signed certificate time-stamp.
	RequireSignedCertificateTimestamp *BoolValue `` /* 164-byte string literal not displayed */
	// An optional `certificate revocation list
	// <http://https://en.wikipedia.org/wiki/Certificate_revocation_list>`_
	// (in PEM format). If specified, Envoy will verify that the presented peer
	// certificate has not been revoked by this CRL. If this DataSource contains
	// multiple CRLs, all of them will be used.
	Crl *DataSource `protobuf:"bytes,7,opt,name=crl,proto3" json:"crl,omitempty"`
	// contains filtered or unexported fields
}

type CidrRange struct {

	// IPv4 or IPv6 address, e.g. “192.0.0.0“ or “2001:db8::“.
	AddressPrefix string `protobuf:"bytes,1,opt,name=address_prefix,json=addressPrefix,proto3" json:"address_prefix,omitempty"`
	// Length of prefix, e.g. 0, 32.
	PrefixLen *UInt32Value `protobuf:"bytes,2,opt,name=prefix_len,json=prefixLen,proto3" json:"prefix_len,omitempty"`
	// contains filtered or unexported fields
}

type CircuitBreakers struct {

	// If multiple :ref:`Thresholds<envoy_api_msg_config.cluster.v3.CircuitBreakers.Thresholds>`
	// are defined with the same :ref:`RoutingPriority<envoy_api_enum_config.core.v3.RoutingPriority>`,
	// the first one in the list is used. If no Thresholds is defined for a given
	// :ref:`RoutingPriority<envoy_api_enum_config.core.v3.RoutingPriority>`, the default values
	// are used.
	Thresholds []*CircuitBreakers_Thresholds `protobuf:"bytes,1,rep,name=thresholds,proto3" json:"thresholds,omitempty"`
	// contains filtered or unexported fields
}

type CircuitBreakers_Thresholds struct {

	// The :ref:`RoutingPriority<envoy_api_enum_config.core.v3.RoutingPriority>`
	// the specified CircuitBreaker settings apply to.
	Priority RoutingPriority `protobuf:"varint,1,opt,name=priority,proto3,enum=xds.RoutingPriority" json:"priority,omitempty"`
	// The maximum number of connections that Envoy will make to the upstream
	// cluster. If not specified, the default is 1024.
	MaxConnections *UInt32Value `protobuf:"bytes,2,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
	// The maximum number of pending requests that Envoy will allow to the
	// upstream cluster. If not specified, the default is 1024.
	MaxPendingRequests *UInt32Value `protobuf:"bytes,3,opt,name=max_pending_requests,json=maxPendingRequests,proto3" json:"max_pending_requests,omitempty"`
	// The maximum number of parallel requests that Envoy will make to the
	// upstream cluster. If not specified, the default is 1024.
	MaxRequests *UInt32Value `protobuf:"bytes,4,opt,name=max_requests,json=maxRequests,proto3" json:"max_requests,omitempty"`
	// The maximum number of parallel retries that Envoy will allow to the
	// upstream cluster. If not specified, the default is 3.
	MaxRetries *UInt32Value `protobuf:"bytes,5,opt,name=max_retries,json=maxRetries,proto3" json:"max_retries,omitempty"`
	// Specifies a limit on concurrent retries in relation to the number of active requests. This
	// parameter is optional.
	//
	// .. note::
	//
	//	If this field is set, the retry budget will override any configured retry circuit
	//	breaker.
	RetryBudget *CircuitBreakers_Thresholds_RetryBudget `protobuf:"bytes,8,opt,name=retry_budget,json=retryBudget,proto3" json:"retry_budget,omitempty"`
	// If track_remaining is true, then stats will be published that expose
	// the number of resources remaining until the circuit breakers open. If
	// not specified, the default is false.
	//
	// .. note::
	//
	//	If a retry budget is used in lieu of the max_retries circuit breaker,
	//	the remaining retry resources remaining will not be tracked.
	TrackRemaining bool `protobuf:"varint,6,opt,name=track_remaining,json=trackRemaining,proto3" json:"track_remaining,omitempty"`
	// The maximum number of connection pools per cluster that Envoy will concurrently support at
	// once. If not specified, the default is unlimited. Set this for clusters which create a
	// large number of connection pools. See
	// :ref:`Circuit Breaking <arch_overview_circuit_break_cluster_maximum_connection_pools>` for
	// more details.
	MaxConnectionPools *UInt32Value `protobuf:"bytes,7,opt,name=max_connection_pools,json=maxConnectionPools,proto3" json:"max_connection_pools,omitempty"`
	// contains filtered or unexported fields
}

type CircuitBreakers_Thresholds_RetryBudget struct {

	// Specifies the limit on concurrent retries as a percentage of the sum of active requests and
	// active pending requests. For example, if there are 100 active requests and the
	// budget_percent is set to 25, there may be 25 active retries.
	//
	// This parameter is optional. Defaults to 20%.
	BudgetPercent *Percent `protobuf:"bytes,1,opt,name=budget_percent,json=budgetPercent,proto3" json:"budget_percent,omitempty"`
	// Specifies the minimum retry concurrency allowed for the retry budget. The limit on the
	// number of active retries may never go below this number.
	//
	// This parameter is optional. Defaults to 3.
	MinRetryConcurrency *UInt32Value `protobuf:"bytes,2,opt,name=min_retry_concurrency,json=minRetryConcurrency,proto3" json:"min_retry_concurrency,omitempty"`
	// contains filtered or unexported fields
}

type Cluster struct {

	// Supplies the name of the cluster which must be unique across all clusters.
	// The cluster name is used when emitting
	// :ref:`statistics <config_cluster_manager_cluster_stats>` if :ref:`alt_stat_name
	// <envoy_api_field_Cluster.alt_stat_name>` is not provided.
	// Any “:“ in the cluster name will be converted to “_“ when emitting statistics.
	// By default, the maximum length of a cluster name is limited to 60
	// characters. This limit can be increased by setting the
	// :option:`--max-obj-name-len` command line argument to the desired value.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// An optional alternative to the cluster name to be used while emitting stats.
	// Any “:“ in the name will be converted to “_“ when emitting statistics. This should not be
	// confused with :ref:`Router Filter Header
	// <config_http_filters_router_x-envoy-upstream-alt-stat-name>`.
	AltStatName string `protobuf:"bytes,28,opt,name=alt_stat_name,json=altStatName,proto3" json:"alt_stat_name,omitempty"`
	// The :ref:`service discovery type <arch_overview_service_discovery_types>`
	// to use for resolving the cluster.
	Type Cluster_DiscoveryType `protobuf:"varint,2,opt,name=type,proto3,enum=xds.Cluster_DiscoveryType" json:"type,omitempty"`
	// Configuration to use for EDS updates for the Cluster.
	EdsClusterConfig *Cluster_EdsClusterConfig `protobuf:"bytes,3,opt,name=eds_cluster_config,json=edsClusterConfig,proto3" json:"eds_cluster_config,omitempty"`
	// The timeout for new network connections to hosts in the cluster.
	ConnectTimeout *Duration `protobuf:"bytes,4,opt,name=connect_timeout,json=connectTimeout,proto3" json:"connect_timeout,omitempty"`
	// Soft limit on size of the cluster’s connections read and write buffers. If
	// unspecified, an implementation defined default is applied (1MiB).
	PerConnectionBufferLimitBytes *UInt32Value `` /* 154-byte string literal not displayed */
	// The :ref:`load balancer type <arch_overview_load_balancing_types>` to use
	// when picking a host in the cluster.
	LbPolicy Cluster_LbPolicy `protobuf:"varint,6,opt,name=lb_policy,json=lbPolicy,proto3,enum=xds.Cluster_LbPolicy" json:"lb_policy,omitempty"`
	// If the service discovery type is
	// :ref:`STATIC<envoy_api_enum_value_Cluster.DiscoveryType.STATIC>`,
	// :ref:`STRICT_DNS<envoy_api_enum_value_Cluster.DiscoveryType.STRICT_DNS>`
	// or :ref:`LOGICAL_DNS<envoy_api_enum_value_Cluster.DiscoveryType.LOGICAL_DNS>`,
	// then hosts is required.
	Hosts []*Address `protobuf:"bytes,7,rep,name=hosts,proto3" json:"hosts,omitempty"`
	// Optional maximum requests for a single upstream connection. This parameter
	// is respected by both the HTTP/1.1 and HTTP/2 connection pool
	// implementations. If not specified, there is no limit. Setting this
	// parameter to 1 will effectively disable keep alive.
	MaxRequestsPerConnection *UInt32Value `` /* 137-byte string literal not displayed */
	// Optional :ref:`circuit breaking <arch_overview_circuit_break>` for the cluster.
	CircuitBreakers *CircuitBreakers `protobuf:"bytes,10,opt,name=circuit_breakers,json=circuitBreakers,proto3" json:"circuit_breakers,omitempty"`
	// If the DNS refresh rate is specified and the cluster type is either
	// :ref:`STRICT_DNS<envoy_api_enum_value_Cluster.DiscoveryType.STRICT_DNS>`,
	// or :ref:`LOGICAL_DNS<envoy_api_enum_value_Cluster.DiscoveryType.LOGICAL_DNS>`,
	// this value is used as the cluster’s DNS refresh
	// rate. If this setting is not specified, the value defaults to 5000. For
	// cluster types other than
	// :ref:`STRICT_DNS<envoy_api_enum_value_Cluster.DiscoveryType.STRICT_DNS>`
	// and :ref:`LOGICAL_DNS<envoy_api_enum_value_Cluster.DiscoveryType.LOGICAL_DNS>`
	// this setting is ignored.
	DnsRefreshRate *Duration `protobuf:"bytes,16,opt,name=dns_refresh_rate,json=dnsRefreshRate,proto3" json:"dns_refresh_rate,omitempty"`
	// The DNS IP address resolution policy. If this setting is not specified, the
	// value defaults to
	// :ref:`AUTO<envoy_api_enum_value_Cluster.DnsLookupFamily.AUTO>`.
	DnsLookupFamily Cluster_DnsLookupFamily `` /* 143-byte string literal not displayed */
	// If DNS resolvers are specified and the cluster type is either
	// :ref:`STRICT_DNS<envoy_api_enum_value_Cluster.DiscoveryType.STRICT_DNS>`,
	// or :ref:`LOGICAL_DNS<envoy_api_enum_value_Cluster.DiscoveryType.LOGICAL_DNS>`,
	// this value is used to specify the cluster’s dns resolvers.
	// If this setting is not specified, the value defaults to the default
	// resolver, which uses /etc/resolv.conf for configuration. For cluster types
	// other than
	// :ref:`STRICT_DNS<envoy_api_enum_value_Cluster.DiscoveryType.STRICT_DNS>`
	// and :ref:`LOGICAL_DNS<envoy_api_enum_value_Cluster.DiscoveryType.LOGICAL_DNS>`
	// this setting is ignored.
	DnsResolvers []*Address `protobuf:"bytes,18,rep,name=dns_resolvers,json=dnsResolvers,proto3" json:"dns_resolvers,omitempty"`
	// The interval for removing stale hosts from a cluster type
	// :ref:`ORIGINAL_DST<envoy_api_enum_value_Cluster.DiscoveryType.ORIGINAL_DST>`.
	// Hosts are considered stale if they have not been used
	// as upstream destinations during this interval. New hosts are added
	// to original destination clusters on demand as new connections are
	// redirected to Envoy, causing the number of hosts in the cluster to
	// grow over time. Hosts that are not stale (they are actively used as
	// destinations) are kept in the cluster, which allows connections to
	// them remain open, saving the latency that would otherwise be spent
	// on opening new connections. If this setting is not specified, the
	// value defaults to 5000ms. For cluster types other than
	// :ref:`ORIGINAL_DST<envoy_api_enum_value_Cluster.DiscoveryType.ORIGINAL_DST>`
	// this setting is ignored.
	CleanupInterval *Duration `protobuf:"bytes,20,opt,name=cleanup_interval,json=cleanupInterval,proto3" json:"cleanup_interval,omitempty"`
	// Optional configuration used to bind newly established upstream connections.
	// This overrides any bind_config specified in the bootstrap proto.
	// If the address and port are empty, no bind will be performed.
	UpstreamBindConfig *BindConfig `protobuf:"bytes,21,opt,name=upstream_bind_config,json=upstreamBindConfig,proto3" json:"upstream_bind_config,omitempty"`
	// Configuration for load balancing subsetting.
	LbSubsetConfig *Cluster_LbSubsetConfig `protobuf:"bytes,22,opt,name=lb_subset_config,json=lbSubsetConfig,proto3" json:"lb_subset_config,omitempty"`
	// Optional configuration for the load balancing algorithm selected by
	// LbPolicy. Currently only
	// :ref:`RING_HASH<envoy_api_enum_value_Cluster.LbPolicy.RING_HASH>`
	// has additional configuration options.
	// Specifying ring_hash_lb_config without setting the LbPolicy to
	// :ref:`RING_HASH<envoy_api_enum_value_Cluster.LbPolicy.RING_HASH>`
	// will generate an error at runtime.
	//
	// Types that are assignable to LbConfig:
	//
	//	*Cluster_RingHashLbConfig_
	LbConfig isCluster_LbConfig `protobuf_oneof:"lb_config"`
	// Common configuration for all load balancer implementations.
	CommonLbConfig *Cluster_CommonLbConfig `protobuf:"bytes,27,opt,name=common_lb_config,json=commonLbConfig,proto3" json:"common_lb_config,omitempty"`
	// The Metadata field can be used to provide additional information about the
	// cluster. It can be used for stats, logging, and varying filter behavior.
	// Fields should use reverse DNS notation to denote which entity within Envoy
	// will need the information. For instance, if the metadata is intended for
	// the Router filter, the filter name should be specified as *envoy.router*.
	Metadata *Metadata `protobuf:"bytes,25,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Determines how Envoy selects the protocol used to speak to upstream hosts.
	ProtocolSelection      Cluster_ClusterProtocolSelection `` /* 156-byte string literal not displayed */
	Filters                []*ClusterFilter                 `protobuf:"bytes,40,rep,name=filters,proto3" json:"filters,omitempty"`
	TransportSocketMatches []*TransportSocketMatch          `` /* 130-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ClusterFilter struct {

	// The name of the filter to instantiate. The name must match a
	// :ref:`supported filter <config_network_filters>`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Filter specific configuration which depends on the filter being
	// instantiated. See the supported filters for further documentation.
	TypedConfig *Any `protobuf:"bytes,2,opt,name=typed_config,json=typedConfig,proto3" json:"typed_config,omitempty"`
	// contains filtered or unexported fields
}

type ClusterLoadAssignment struct {

	// Name of the cluster. This will be the :ref:`service_name
	// <envoy_api_field_Cluster.EdsClusterConfig.service_name>` value if specified
	// in the cluster :ref:`EdsClusterConfig
	// <envoy_api_msg_Cluster.EdsClusterConfig>`.
	ClusterName string `protobuf:"bytes,1,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
	// List of endpoints to load balance to.
	Endpoints []*LocalityLbEndpoints `protobuf:"bytes,2,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	// contains filtered or unexported fields
}

type Cluster_ClusterProtocolSelection int32

type Cluster_CommonLbConfig struct {
	// contains filtered or unexported fields
}

type Cluster_DiscoveryType int32

type Cluster_DnsLookupFamily int32

type Cluster_EdsClusterConfig struct {

	// Configuration for the source of EDS updates for this Cluster.
	EdsConfig *ConfigSource `protobuf:"bytes,1,opt,name=eds_config,json=edsConfig,proto3" json:"eds_config,omitempty"`
	// Optional alternative to cluster name to present to EDS. This does not
	// have the same restrictions as cluster name, i.e. it may be arbitrary
	// length.
	ServiceName string `protobuf:"bytes,2,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// contains filtered or unexported fields
}

type Cluster_LbPolicy int32

type Cluster_LbSubsetConfig struct {

	// The behavior used when no endpoint subset matches the selected route's
	// metadata. The value defaults to
	// :ref:`NO_FALLBACK<envoy_api_enum_value_Cluster.LbSubsetConfig.LbSubsetFallbackPolicy.NO_FALLBACK>`.
	FallbackPolicy Cluster_LbSubsetConfig_LbSubsetFallbackPolicy `` /* 159-byte string literal not displayed */
	// Specifies the default subset of endpoints used during fallback if
	// fallback_policy is
	// :ref:`DEFAULT_SUBSET<envoy_api_enum_value_Cluster.LbSubsetConfig.LbSubsetFallbackPolicy.DEFAULT_SUBSET>`.
	// Each field in default_subset is
	// compared to the matching LbEndpoint.Metadata under the *envoy.lb*
	// namespace. It is valid for no hosts to match, in which case the behavior
	// is the same as a fallback_policy of
	// :ref:`NO_FALLBACK<envoy_api_enum_value_Cluster.LbSubsetConfig.LbSubsetFallbackPolicy.NO_FALLBACK>`.
	DefaultSubset *Struct `protobuf:"bytes,2,opt,name=default_subset,json=defaultSubset,proto3" json:"default_subset,omitempty"`
	// For each entry, LbEndpoint.Metadata's
	// *envoy.lb* namespace is traversed and a subset is created for each unique
	// combination of key and value. For example:
	//
	// .. code-block:: json
	//
	//	{ "subset_selectors": [
	//	    { "keys": [ "version" ] },
	//	    { "keys": [ "stage", "hardware_type" ] }
	//	]}
	//
	// A subset is matched when the metadata from the selected route and
	// weighted cluster contains the same keys and values as the subset's
	// metadata. The same host may appear in multiple subsets.
	SubsetSelectors []*Cluster_LbSubsetConfig_LbSubsetSelector `protobuf:"bytes,3,rep,name=subset_selectors,json=subsetSelectors,proto3" json:"subset_selectors,omitempty"`
	// contains filtered or unexported fields
}

type Cluster_LbSubsetConfig_LbSubsetFallbackPolicy int32

type Cluster_LbSubsetConfig_LbSubsetSelector struct {

	// List of keys to match with the weighted cluster metadata.
	Keys []string `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
	// contains filtered or unexported fields
}

type Cluster_RingHashLbConfig struct {

	// Deprecated settings from v1 config.
	// [#not-implemented-hide:] Hide from docs.
	//
	// Deprecated: Marked as deprecated in xds/cds.proto.
	DeprecatedV1 *Cluster_RingHashLbConfig_DeprecatedV1 `protobuf:"bytes,2,opt,name=deprecated_v1,json=deprecatedV1,proto3" json:"deprecated_v1,omitempty"`
	// contains filtered or unexported fields
}

type Cluster_RingHashLbConfig_ struct {
	// Optional configuration for the Ring Hash load balancing policy.
	RingHashLbConfig *Cluster_RingHashLbConfig `protobuf:"bytes,23,opt,name=ring_hash_lb_config,json=ringHashLbConfig,proto3,oneof"`
}

type Cluster_RingHashLbConfig_DeprecatedV1 struct {

	// Defaults to true, meaning that std::hash is used to hash hosts onto
	// the ketama ring. std::hash can vary by platform. For this reason,
	// Envoy will eventually use `xxHash <https://github.com/Cyan4973/xxHash>`_
	// by default. This field exists for
	// migration purposes and will eventually be deprecated. Set it to false
	// to use `xxHash <https://github.com/Cyan4973/xxHash>`_ now.
	UseStdHash *BoolValue `protobuf:"bytes,1,opt,name=use_std_hash,json=useStdHash,proto3" json:"use_std_hash,omitempty"`
	// contains filtered or unexported fields
}

type CommonTlsContext struct {

	// TLS protocol versions, cipher suites etc.
	TlsParams *TlsParameters `protobuf:"bytes,1,opt,name=tls_params,json=tlsParams,proto3" json:"tls_params,omitempty"`
	// Multiple TLS certificates can be associated with the same context.
	// E.g. to allow both RSA and ECDSA certificates, two TLS certificates can be configured.
	//
	// .. attention::
	//
	//	Although this is a list, currently only a single certificate is supported. This will be
	//	relaxed in the future.
	TlsCertificates []*TlsCertificate `protobuf:"bytes,2,rep,name=tls_certificates,json=tlsCertificates,proto3" json:"tls_certificates,omitempty"`
	// How to validate peer certificates.
	ValidationContext *CertificateValidationContext `protobuf:"bytes,3,opt,name=validation_context,json=validationContext,proto3" json:"validation_context,omitempty"`
	// Supplies the list of ALPN protocols that the listener should expose. In
	// practice this is likely to be set to one of two values (see the
	// :ref:`codec_type <config_http_conn_man_codec_type>` parameter in the HTTP connection
	// manager for more information):
	//
	// * "h2,http/1.1" If the listener is going to support both HTTP/2 and HTTP/1.1.
	// * "http/1.1" If the listener is only going to support HTTP/1.1.
	//
	// There is no default for this parameter. If empty, Envoy will not expose ALPN.
	AlpnProtocols []string `protobuf:"bytes,4,rep,name=alpn_protocols,json=alpnProtocols,proto3" json:"alpn_protocols,omitempty"`
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in xds/lds.proto.
	DeprecatedV1 *CommonTlsContext_DeprecatedV1 `protobuf:"bytes,5,opt,name=deprecated_v1,json=deprecatedV1,proto3" json:"deprecated_v1,omitempty"`
	// contains filtered or unexported fields
}

type CommonTlsContext_DeprecatedV1 struct {
	AltAlpnProtocols string `protobuf:"bytes,1,opt,name=alt_alpn_protocols,json=altAlpnProtocols,proto3" json:"alt_alpn_protocols,omitempty"`
	// contains filtered or unexported fields
}

type ConfigSource struct {

	// Types that are assignable to ConfigSourceSpecifier:
	//
	//	*ConfigSource_Path
	//	*ConfigSource_Ads
	ConfigSourceSpecifier isConfigSource_ConfigSourceSpecifier `protobuf_oneof:"config_source_specifier"`
	// When this timeout is specified, Envoy will wait no longer than the specified time for first
	// config response on this xDS subscription during the :ref:`initialization process
	// <arch_overview_initialization>`. After reaching the timeout, Envoy will move to the next
	// initialization phase, even if the first config is not delivered yet. The timer is activated
	// when the xDS API subscription starts, and is disarmed on first config update or on error. 0
	// means no timeout - Envoy will wait indefinitely for the first xDS config (unless another
	// timeout applies). The default is 15s.
	InitialFetchTimeout *Duration `protobuf:"bytes,4,opt,name=initial_fetch_timeout,json=initialFetchTimeout,proto3" json:"initial_fetch_timeout,omitempty"`
	// contains filtered or unexported fields
}

type ConfigSource_Ads struct {
	// When set, ADS will be used to fetch resources. The ADS API configuration
	// source in the bootstrap configuration is used.
	Ads *AggregatedConfigSource `protobuf:"bytes,3,opt,name=ads,proto3,oneof"`
}

type ConfigSource_Path struct {
	// Path on the filesystem to source and watch for configuration updates.
	// When sourcing configuration for :ref:`secret <envoy_api_msg_extensions.transport_sockets.tls.v3.Secret>`,
	// the certificate and key files are also watched for updates.
	//
	// .. note::
	//
	//	The path to the source must exist at config load time.
	//
	// .. note::
	//
	//	Envoy will only watch the file path for *moves.* This is because in general only moves
	//	are atomic. The same method of swapping files as is demonstrated in the
	//	:ref:`runtime documentation <config_runtime_symbolic_link_swap>` can be used here also.
	Path string `protobuf:"bytes,1,opt,name=path,proto3,oneof"`
}

type DataSource struct {

	// Types that are assignable to Specifier:
	//
	//	*DataSource_Filename
	//	*DataSource_InlineBytes
	//	*DataSource_InlineString
	Specifier isDataSource_Specifier `protobuf_oneof:"specifier"`
	// contains filtered or unexported fields
}

type DataSource_Filename struct {
	// Local filesystem data source.
	Filename string `protobuf:"bytes,1,opt,name=filename,proto3,oneof"`
}

type DataSource_InlineBytes struct {
	// Bytes inlined in the configuration.
	InlineBytes []byte `protobuf:"bytes,2,opt,name=inline_bytes,json=inlineBytes,proto3,oneof"`
}

type DataSource_InlineString struct {
	// String inlined in the configuration.
	InlineString string `protobuf:"bytes,3,opt,name=inline_string,json=inlineString,proto3,oneof"`
}

type DeltaDiscoveryRequest struct {

	// The node making the request.
	Node *Node `protobuf:"bytes,1,opt,name=node,proto3" json:"node,omitempty"`
	// Type of the resource that is being requested, e.g.
	// “type.googleapis.com/envoy.api.v2.ClusterLoadAssignment“. This does not need to be set if
	// resources are only referenced via “xds_resource_subscribe“ and
	// “xds_resources_unsubscribe“.
	TypeUrl string `protobuf:"bytes,2,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
	// DeltaDiscoveryRequests allow the client to add or remove individual
	// resources to the set of tracked resources in the context of a stream.
	// All resource names in the resource_names_subscribe list are added to the
	// set of tracked resources and all resource names in the resource_names_unsubscribe
	// list are removed from the set of tracked resources.
	//
	// *Unlike* state-of-the-world xDS, an empty resource_names_subscribe or
	// resource_names_unsubscribe list simply means that no resources are to be
	// added or removed to the resource list.
	// *Like* state-of-the-world xDS, the server must send updates for all tracked
	// resources, but can also send updates for resources the client has not subscribed to.
	//
	// NOTE: the server must respond with all resources listed in resource_names_subscribe,
	// even if it believes the client has the most recent version of them. The reason:
	// the client may have dropped them, but then regained interest before it had a chance
	// to send the unsubscribe message. See DeltaSubscriptionStateTest.RemoveThenAdd.
	//
	// These two fields can be set in any DeltaDiscoveryRequest, including ACKs
	// and initial_resource_versions.
	//
	// A list of Resource names to add to the list of tracked resources.
	ResourceNamesSubscribe []string `` /* 129-byte string literal not displayed */
	// A list of Resource names to remove from the list of tracked resources.
	ResourceNamesUnsubscribe []string `` /* 135-byte string literal not displayed */
	// Informs the server of the versions of the resources the xDS client knows of, to enable the
	// client to continue the same logical xDS session even in the face of gRPC stream reconnection.
	// It will not be populated: [1] in the very first stream of a session, since the client will
	// not yet have any resources,  [2] in any message after the first in a stream (for a given
	// type_url), since the server will already be correctly tracking the client's state.
	// (In ADS, the first message *of each type_url* of a reconnected stream populates this map.)
	// The map's keys are names of xDS resources known to the xDS client.
	// The map's values are opaque resource versions.
	InitialResourceVersions map[string]string `` /* 220-byte string literal not displayed */
	// When the DeltaDiscoveryRequest is a ACK or NACK message in response
	// to a previous DeltaDiscoveryResponse, the response_nonce must be the
	// nonce in the DeltaDiscoveryResponse.
	// Otherwise (unlike in DiscoveryRequest) response_nonce must be omitted.
	ResponseNonce string `protobuf:"bytes,6,opt,name=response_nonce,json=responseNonce,proto3" json:"response_nonce,omitempty"`
	// This is populated when the previous :ref:`DiscoveryResponse <envoy_v3_api_msg_service.discovery.v3.DiscoveryResponse>`
	// failed to update configuration. The “message“ field in “error_details“
	// provides the Envoy internal exception related to the failure.
	ErrorDetail *Status `protobuf:"bytes,7,opt,name=error_detail,json=errorDetail,proto3" json:"error_detail,omitempty"`
	// contains filtered or unexported fields
}

type DeltaDiscoveryResponse struct {

	// The version of the response data (used for debugging).
	SystemVersionInfo string `protobuf:"bytes,1,opt,name=system_version_info,json=systemVersionInfo,proto3" json:"system_version_info,omitempty"`
	// The response resources. These are typed resources, whose types must match
	// the type_url field.
	Resources []*Resource `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"`
	// Type URL for resources. Identifies the xDS API when muxing over ADS.
	// Must be consistent with the type_url in the Any within 'resources' if 'resources' is non-empty.
	TypeUrl string `protobuf:"bytes,4,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
	// Resources names of resources that have be deleted and to be removed from the xDS Client.
	// Removed resources for missing resources can be ignored.
	RemovedResources []string `protobuf:"bytes,6,rep,name=removed_resources,json=removedResources,proto3" json:"removed_resources,omitempty"`
	// The nonce provides a way for DeltaDiscoveryRequests to uniquely
	// reference a DeltaDiscoveryResponse when (N)ACKing. The nonce is required.
	Nonce string `protobuf:"bytes,5,opt,name=nonce,proto3" json:"nonce,omitempty"`
	// contains filtered or unexported fields
}

type DiscoveryRequest struct {

	// The version_info provided in the request messages will be the version_info
	// received with the most recent successfully processed response or empty on
	// the first request. It is expected that no new request is sent after a
	// response is received until the Envoy instance is ready to ACK/NACK the new
	// configuration. ACK/NACK takes place by returning the new API config version
	// as applied or the previous API config version respectively. Each type_url
	// (see below) has an independent version associated with it.
	VersionInfo string `protobuf:"bytes,1,opt,name=version_info,json=versionInfo,proto3" json:"version_info,omitempty"`
	// The node making the request.
	Node *Node `protobuf:"bytes,2,opt,name=node,proto3" json:"node,omitempty"`
	// List of resources to subscribe to, e.g. list of cluster names or a route
	// configuration name. If this is empty, all resources for the API are
	// returned. LDS/CDS expect empty resource_names, since this is global
	// discovery for the Envoy instance. The LDS and CDS responses will then imply
	// a number of resources that need to be fetched via EDS/RDS, which will be
	// explicitly enumerated in resource_names.
	ResourceNames []string `protobuf:"bytes,3,rep,name=resource_names,json=resourceNames,proto3" json:"resource_names,omitempty"`
	// Type of the resource that is being requested, e.g.
	// "type.googleapis.com/envoy.api.v2.ClusterLoadAssignment". This is implicit
	// in requests made via singleton xDS APIs such as CDS, LDS, etc. but is
	// required for ADS.
	TypeUrl string `protobuf:"bytes,4,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
	// nonce corresponding to DiscoveryResponse being ACK/NACKed. See above
	// discussion on version_info and the DiscoveryResponse nonce comment. This
	// may be empty if no nonce is available, e.g. at startup or for non-stream
	// xDS implementations.
	ResponseNonce string `protobuf:"bytes,5,opt,name=response_nonce,json=responseNonce,proto3" json:"response_nonce,omitempty"`
	// This is populated when the previous :ref:`DiscoveryResponse <envoy_api_msg_DiscoveryResponse>`
	// failed to update configuration. The *message* field in *error_details* provides the Envoy
	// internal exception related to the failure. It is only intended for consumption during manual
	// debugging, the string provided is not guaranteed to be stable across Envoy versions.
	// google.rpc.Status
	ErrorDetail *Status `protobuf:"bytes,6,opt,name=error_detail,json=errorDetail,proto3" json:"error_detail,omitempty"`
	// Extension to Envoy - allow push
	Resources []*Any `protobuf:"bytes,7,rep,name=resources,proto3" json:"resources,omitempty"`
	// contains filtered or unexported fields
}

type DiscoveryResponse struct {

	// The version of the response data.
	VersionInfo string `protobuf:"bytes,1,opt,name=version_info,json=versionInfo,proto3" json:"version_info,omitempty"`
	// The response resources. These resources are typed and depend on the API being called.
	// google.protobuf.Any
	Resources []*Any `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"`
	// [#not-implemented-hide:]
	// Canary is used to support two Envoy command line flags:
	//
	//   - --terminate-on-canary-transition-failure. When set, Envoy is able to
	//     terminate if it detects that configuration is stuck at canary. Consider
	//     this example sequence of updates:
	//   - Management server applies a canary config successfully.
	//   - Management server rolls back to a production config.
	//   - Envoy rejects the new production config.
	//     Since there is no sensible way to continue receiving configuration
	//     updates, Envoy will then terminate and apply production config from a
	//     clean slate.
	//   - --dry-run-canary. When set, a canary response will never be applied, only
	//     validated via a dry run.
	Canary bool `protobuf:"varint,3,opt,name=canary,proto3" json:"canary,omitempty"`
	// Type URL for resources. This must be consistent with the type_url in the
	// Any messages for resources if resources is non-empty. This effectively
	// identifies the xDS API when muxing over ADS.
	TypeUrl string `protobuf:"bytes,4,opt,name=type_url,json=typeUrl,proto3" json:"type_url,omitempty"`
	// For gRPC based subscriptions, the nonce provides a way to explicitly ack a
	// specific DiscoveryResponse in a following DiscoveryRequest. Additional
	// messages may have been sent by Envoy to the management server for the
	// previous version on the stream prior to this DiscoveryResponse, that were
	// unprocessed at response send time. The nonce allows the management server
	// to ignore any further DiscoveryRequests for the previous version until a
	// DiscoveryRequest bearing the nonce. The nonce is optional and is not
	// required for non-stream based xDS implementations.
	Nonce        string                          `protobuf:"bytes,5,opt,name=nonce,proto3" json:"nonce,omitempty"`
	ControlPlane *DiscoveryResponse_ControlPlane `protobuf:"bytes,6,opt,name=controlPlane,proto3" json:"controlPlane,omitempty"`
	// contains filtered or unexported fields
}

type DiscoveryResponse_ControlPlane struct {
	Identifier string `protobuf:"bytes,1,opt,name=Identifier,proto3" json:"Identifier,omitempty"`
	// contains filtered or unexported fields
}

type DownstreamTlsContext struct {

	// Common TLS context settings.
	CommonTlsContext *CommonTlsContext `protobuf:"bytes,1,opt,name=common_tls_context,json=commonTlsContext,proto3" json:"common_tls_context,omitempty"`
	// If specified, Envoy will reject connections without a valid client
	// certificate.
	RequireClientCertificate *BoolValue `` /* 135-byte string literal not displayed */
	// If specified, Envoy will reject connections without a valid and matching SNI.
	// [#not-implemented-hide:]
	RequireSni *BoolValue `protobuf:"bytes,3,opt,name=require_sni,json=requireSni,proto3" json:"require_sni,omitempty"`
	// contains filtered or unexported fields
}

type Duration struct {

	// Signed seconds of the span of time. Must be from -315,576,000,000
	// to +315,576,000,000 inclusive. Note: these bounds are computed from:
	// 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
	Seconds int64 `protobuf:"varint,1,opt,name=seconds,proto3" json:"seconds,omitempty"`
	// Signed fractions of a second at nanosecond resolution of the span
	// of time. Durations less than one second are represented with a 0
	// `seconds` field and a positive or negative `nanos` field. For durations
	// of one second or more, a non-zero value for the `nanos` field must be
	// of the same sign as the `seconds` field. Must be from -999,999,999
	// to +999,999,999 inclusive.
	Nanos int32 `protobuf:"varint,2,opt,name=nanos,proto3" json:"nanos,omitempty"`
	// contains filtered or unexported fields
}

type Endpoint struct {
	Address *Address `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// contains filtered or unexported fields
}

type Filter struct {

	// The name of the filter to instantiate. The name must match a supported
	// filter. The built-in filters are:
	//
	// [#comment:TODO(mattklein123): Auto generate the following list]
	// * :ref:`envoy.client_ssl_auth<config_network_filters_client_ssl_auth>`
	// * :ref:`envoy.echo <config_network_filters_echo>`
	// * :ref:`envoy.http_connection_manager <config_http_conn_man>`
	// * :ref:`envoy.mongo_proxy <config_network_filters_mongo_proxy>`
	// * :ref:`envoy.ratelimit <config_network_filters_rate_limit>`
	// * :ref:`envoy.redis_proxy <config_network_filters_redis_proxy>`
	// * :ref:`envoy.tcp_proxy <config_network_filters_tcp_proxy>`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Types that are assignable to ConfigType:
	//
	//	*Filter_TypedConfig
	ConfigType isFilter_ConfigType `protobuf_oneof:"config_type"`
	// [#not-implemented-hide:]
	//
	// Deprecated: Marked as deprecated in xds/envoy_base.proto.
	DeprecatedV1 *Filter_DeprecatedV1 `protobuf:"bytes,3,opt,name=deprecated_v1,json=deprecatedV1,proto3" json:"deprecated_v1,omitempty"`
	// contains filtered or unexported fields
}

type FilterChain struct {

	// The criteria to use when matching a connection to this filter chain.
	FilterChainMatch *FilterChainMatch `protobuf:"bytes,1,opt,name=filter_chain_match,json=filterChainMatch,proto3" json:"filter_chain_match,omitempty"`
	// The TLS context for this filter chain.
	TlsContext *DownstreamTlsContext `protobuf:"bytes,2,opt,name=tls_context,json=tlsContext,proto3" json:"tls_context,omitempty"`
	// A list of individual network filters that make up the filter chain for
	// connections established with the listener. Order matters as the filters are
	// processed sequentially as connection events happen. Note: If the filter
	// list is empty, the connection will close by default.
	Filters []*Filter `protobuf:"bytes,3,rep,name=filters,proto3" json:"filters,omitempty"`
	// Whether the listener should expect a PROXY protocol V1 header on new
	// connections. If this option is enabled, the listener will assume that that
	// remote address of the connection is the one specified in the header. Some
	// load balancers including the AWS ELB support this option. If the option is
	// absent or set to false, Envoy will use the physical peer address of the
	// connection as the remote address.
	UseProxyProto *BoolValue `protobuf:"bytes,4,opt,name=use_proxy_proto,json=useProxyProto,proto3" json:"use_proxy_proto,omitempty"`
	// [#not-implemented-hide:] filter chain metadata.
	Metadata *Metadata `protobuf:"bytes,5,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// See :ref:`base.TransportSocket<envoy_api_msg_core.TransportSocket>` description.
	TransportSocket *TransportSocket `protobuf:"bytes,6,opt,name=transport_socket,json=transportSocket,proto3" json:"transport_socket,omitempty"`
	// contains filtered or unexported fields
}

type FilterChainMatch struct {

	// If non-empty, the SNI domains to consider. May contain a wildcard prefix,
	// e.g. “*.example.com“.
	//
	// .. attention::
	//
	//	See the :ref:`FAQ entry <faq_how_to_setup_sni>` on how to configure SNI for more
	//	information.
	SniDomains []string `protobuf:"bytes,1,rep,name=sni_domains,json=sniDomains,proto3" json:"sni_domains,omitempty"`
	// If non-empty, an IP address and prefix length to match addresses when the
	// listener is bound to 0.0.0.0/:: or when use_original_dst is specified.
	// [#not-implemented-hide:]
	PrefixRanges []*CidrRange `protobuf:"bytes,3,rep,name=prefix_ranges,json=prefixRanges,proto3" json:"prefix_ranges,omitempty"`
	// If non-empty, an IP address and suffix length to match addresses when the
	// listener is bound to 0.0.0.0/:: or when use_original_dst is specified.
	// [#not-implemented-hide:]
	AddressSuffix string `protobuf:"bytes,4,opt,name=address_suffix,json=addressSuffix,proto3" json:"address_suffix,omitempty"`
	// [#not-implemented-hide:]
	SuffixLen *UInt32Value `protobuf:"bytes,5,opt,name=suffix_len,json=suffixLen,proto3" json:"suffix_len,omitempty"`
	// The criteria is satisfied if the source IP address of the downstream
	// connection is contained in at least one of the specified subnets. If the
	// parameter is not specified or the list is empty, the source IP address is
	// ignored.
	// [#not-implemented-hide:]
	SourcePrefixRanges []*CidrRange `protobuf:"bytes,6,rep,name=source_prefix_ranges,json=sourcePrefixRanges,proto3" json:"source_prefix_ranges,omitempty"`
	// The criteria is satisfied if the source port of the downstream connection
	// is contained in at least one of the specified ports. If the parameter is
	// not specified, the source port is ignored.
	// [#not-implemented-hide:]
	SourcePorts []*UInt32Value `protobuf:"bytes,7,rep,name=source_ports,json=sourcePorts,proto3" json:"source_ports,omitempty"`
	// Optional destination port to consider when use_original_dst is set on the
	// listener in determining a filter chain match.
	// [#not-implemented-hide:]
	DestinationPort *UInt32Value `protobuf:"bytes,8,opt,name=destination_port,json=destinationPort,proto3" json:"destination_port,omitempty"`
	// contains filtered or unexported fields
}

type Filter_DeprecatedV1 struct {
	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
	// contains filtered or unexported fields
}

type Filter_TypedConfig struct {
	// Filter specific configuration which depends on the filter being
	// instantiated. See the supported filters for further documentation.
	TypedConfig *Any `protobuf:"bytes,4,opt,name=typed_config,json=typedConfig,proto3,oneof"`
}

type HttpConnectionManager struct {

	//	enum CodecType {
	//	    // For every new connection, the connection manager will determine which
	//	    // codec to use. This mode supports both ALPN for TLS listeners as well as
	//	    // protocol inference for plaintext listeners. If ALPN data is available, it
	//	    // is preferred, otherwise protocol inference is used. In almost all cases,
	//	    // this is the right option to choose for this setting.
	//	    AUTO = 0;
	//
	//	    // The connection manager will assume that the client is speaking HTTP/1.1.
	//	    HTTP1 = 1;
	//
	//	    // The connection manager will assume that the client is speaking HTTP/2
	//	    // (Envoy does not require HTTP/2 to take place over TLS or to use ALPN.
	//	    // Prior knowledge is allowed).
	//	    HTTP2 = 2;
	//
	//	    // [#not-implemented-hide:] QUIC implementation is not production ready yet. Use this enum with
	//	    // caution to prevent accidental execution of QUIC code. I.e. `!= HTTP2` is no longer sufficient
	//	    // to distinguish HTTP1 and HTTP2 traffic.
	//	    HTTP3 = 3;
	//	}
	//
	//	enum ServerHeaderTransformation {
	//	    // Overwrite any Server header with the contents of server_name.
	//	    OVERWRITE = 0;
	//
	//	    // If no Server header is present, append Server server_name
	//	    // If a Server header is present, pass it through.
	//	    APPEND_IF_ABSENT = 1;
	//
	//	    // Pass through the value of the server header, and do not append a header
	//	    // if none is present.
	//	    PASS_THROUGH = 2;
	//	}
	//
	//	// How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP
	//	// header.
	//	enum ForwardClientCertDetails {
	//	    // Do not send the XFCC header to the next hop. This is the default value.
	//	    SANITIZE = 0;
	//
	//	    // When the client connection is mTLS (Mutual TLS), forward the XFCC header
	//	    // in the request.
	//	    FORWARD_ONLY = 1;
	//
	//	    // When the client connection is mTLS, append the client certificate
	//	    // information to the request’s XFCC header and forward it.
	//	    APPEND_FORWARD = 2;
	//
	//	    // When the client connection is mTLS, reset the XFCC header with the client
	//	    // certificate information and send it to the next hop.
	//	    SANITIZE_SET = 3;
	//
	//	    // Always forward the XFCC header in the request, regardless of whether the
	//	    // client connection is mTLS.
	//	    ALWAYS_FORWARD_ONLY = 4;
	//	}
	//
	//	// [#next-free-field: 10]
	//	message Tracing {
	//	    option (udpa.annotations.versioning).previous_message_type =
	//	        "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager.Tracing";
	//
	//	    enum OperationName {
	//	        // The HTTP listener is used for ingress/incoming requests.
	//	        INGRESS = 0;
	//
	//	        // The HTTP listener is used for egress/outgoing requests.
	//	        EGRESS = 1;
	//	    }
	//
	//	    reserved 1, 2;
	//
	//	    reserved "operation_name", "request_headers_for_tags";
	//
	//	    // Target percentage of requests managed by this HTTP connection manager that will be force
	//	    // traced if the :ref:`x-client-trace-id <config_http_conn_man_headers_x-client-trace-id>`
	//	    // header is set. This field is a direct analog for the runtime variable
	//	    // 'tracing.client_sampling' in the :ref:`HTTP Connection Manager
	//	    // <config_http_conn_man_runtime>`.
	//	    // Default: 100%
	//	    type.v3.Percent client_sampling = 3;
	//
	//	    // Target percentage of requests managed by this HTTP connection manager that will be randomly
	//	    // selected for trace generation, if not requested by the client or not forced. This field is
	//	    // a direct analog for the runtime variable 'tracing.random_sampling' in the
	//	    // :ref:`HTTP Connection Manager <config_http_conn_man_runtime>`.
	//	    // Default: 100%
	//	    type.v3.Percent random_sampling = 4;
	//
	//	    // Target percentage of requests managed by this HTTP connection manager that will be traced
	//	    // after all other sampling checks have been applied (client-directed, force tracing, random
	//	    // sampling). This field functions as an upper limit on the total configured sampling rate. For
	//	    // instance, setting client_sampling to 100% but overall_sampling to 1% will result in only 1%
	//	    // of client requests with the appropriate headers to be force traced. This field is a direct
	//	    // analog for the runtime variable 'tracing.global_enabled' in the
	//	    // :ref:`HTTP Connection Manager <config_http_conn_man_runtime>`.
	//	    // Default: 100%
	//	    type.v3.Percent overall_sampling = 5;
	//
	//	    // Whether to annotate spans with additional data. If true, spans will include logs for stream
	//	    // events.
	//	    bool verbose = 6;
	//
	//	    // Maximum length of the request path to extract and include in the HttpUrl tag. Used to
	//	    // truncate lengthy request paths to meet the needs of a tracing backend.
	//	    // Default: 256
	//	    google.protobuf.UInt32Value max_path_tag_length = 7;
	//
	//	    // A list of custom tags with unique tag name to create tags for the active span.
	//	    repeated type.tracing.v3.CustomTag custom_tags = 8;
	//
	//	    // Configuration for an external tracing provider.
	//	    // If not specified, no tracing will be performed.
	//	    //
	//	    // .. attention::
	//	    //   Please be aware that *envoy.tracers.opencensus* provider can only be configured once
	//	    //   in Envoy lifetime.
	//	    //   Any attempts to reconfigure it or to use different configurations for different HCM filters
	//	    //   will be rejected.
	//	    //   Such a constraint is inherent to OpenCensus itself. It cannot be overcome without changes
	//	    //   on OpenCensus side.
	//	    config.trace.v3.Tracing.Http provider = 9;
	//	}
	//
	//	message InternalAddressConfig {
	//	    option (udpa.annotations.versioning).previous_message_type =
	//	    "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager."
	//	        "InternalAddressConfig";
	//
	//	    // Whether unix socket addresses should be considered internal.
	//	    bool unix_sockets = 1;
	//	}
	//
	//	// [#next-free-field: 7]
	//	message SetCurrentClientCertDetails {
	//	    option (udpa.annotations.versioning).previous_message_type =
	//	    "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager."
	//	        "SetCurrentClientCertDetails";
	//
	//	    reserved 2;
	//
	//	    // Whether to forward the subject of the client cert. Defaults to false.
	//	    google.protobuf.BoolValue subject = 1;
	//
	//	    // Whether to forward the entire client cert in URL encoded PEM format. This will appear in the
	//	    // XFCC header comma separated from other values with the value Cert="PEM".
	//	    // Defaults to false.
	//	    bool cert = 3;
	//
	//	    // Whether to forward the entire client cert chain (including the leaf cert) in URL encoded PEM
	//	    // format. This will appear in the XFCC header comma separated from other values with the value
	//	    // Chain="PEM".
	//	    // Defaults to false.
	//	    bool chain = 6;
	//
	//	    // Whether to forward the DNS type Subject Alternative Names of the client cert.
	//	    // Defaults to false.
	//	    bool dns = 4;
	//
	//	    // Whether to forward the URI type Subject Alternative Name of the client cert. Defaults to
	//	    // false.
	//	    bool uri = 5;
	//	}
	//
	//	// The configuration for HTTP upgrades.
	//	// For each upgrade type desired, an UpgradeConfig must be added.
	//	//
	//	// .. warning::
	//	//
	//	//    The current implementation of upgrade headers does not handle
	//	//    multi-valued upgrade headers. Support for multi-valued headers may be
	//	//    added in the future if needed.
	//	//
	//	// .. warning::
	//	//    The current implementation of upgrade headers does not work with HTTP/2
	//	//    upstreams.
	//	message UpgradeConfig {
	//	    option (udpa.annotations.versioning).previous_message_type =
	//	    "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager."
	//	        "UpgradeConfig";
	//
	//	    // The case-insensitive name of this upgrade, e.g. "websocket".
	//	    // For each upgrade type present in upgrade_configs, requests with
	//	    // Upgrade: [upgrade_type]
	//	    // will be proxied upstream.
	//	    string upgrade_type = 1;
	//
	//	    // If present, this represents the filter chain which will be created for
	//	    // this type of upgrade. If no filters are present, the filter chain for
	//	    // HTTP connections will be used for this upgrade type.
	//	    repeated HttpFilter filters = 2;
	//
	//	    // Determines if upgrades are enabled or disabled by default. Defaults to true.
	//	    // This can be overridden on a per-route basis with :ref:`cluster
	//	    // <envoy_api_field_config.route.v3.RouteAction.upgrade_configs>` as documented in the
	//	    // :ref:`upgrade documentation <arch_overview_upgrades>`.
	//	    google.protobuf.BoolValue enabled = 3;
	//	}
	//
	//	reserved 27, 11;
	//
	//	reserved "idle_timeout";
	//
	//	// Supplies the type of codec that the connection manager should use.
	//	CodecType codec_type = 1 [(validate.rules).enum = {defined_only: true}];
	//
	//	// The human readable prefix to use when emitting statistics for the
	//	// connection manager. See the :ref:`statistics documentation <config_http_conn_man_stats>` for
	//	// more information.
	//	string stat_prefix = 2 [(validate.rules).string = {min_len: 1}];
	//
	// Types that are assignable to RouteSpecifier:
	//
	//	*HttpConnectionManager_Rds
	RouteSpecifier isHttpConnectionManager_RouteSpecifier `protobuf_oneof:"route_specifier"`
	// contains filtered or unexported fields
}

type HttpConnectionManager_Rds struct {
	// The connection manager’s route table will be dynamically loaded via the RDS API.
	Rds *Rds `protobuf:"bytes,3,opt,name=rds,proto3,oneof"`
}

type LbEndpoint struct {

	// Upstream host identifier
	Endpoint *Endpoint `protobuf:"bytes,1,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
	// The endpoint metadata specifies values that may be used by the load
	// balancer to select endpoints in a cluster for a given request. The filter
	// name should be specified as *envoy.lb*. An example boolean key-value pair
	// is *canary*, providing the optional canary status of the upstream host.
	// This may be matched against in a route's ForwardAction metadata_match field
	// to subset the endpoints considered in cluster load balancing.
	Metadata *Metadata `protobuf:"bytes,3,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// The optional load balancing weight of the upstream host, in the range 1 -
	// 128. Envoy uses the load balancing weight in some of the built in load
	// balancers. The load balancing weight for an endpoint is divided by the sum
	// of the weights of all endpoints in the endpoint's locality to produce a
	// percentage of traffic for the endpoint. This percentage is then further
	// weighted by the endpoint's locality's load balancing weight from
	// LocalityLbEndpoints. If unspecified, each host is presumed to have equal
	// weight in a locality.
	//
	// .. attention::
	//
	//	The limit of 128 is somewhat arbitrary, but is applied due to performance
	//	concerns with the current implementation and can be removed when
	//	`this issue <https://github.com/envoyproxy/envoy/issues/1285>`_ is fixed.
	LoadBalancingWeight *UInt32Value `protobuf:"bytes,4,opt,name=load_balancing_weight,json=loadBalancingWeight,proto3" json:"load_balancing_weight,omitempty"`
	// contains filtered or unexported fields
}