trafficpolicy

type EgressClusterConfig struct {
	// Name defines the name of the external cluster
	Name string

	// Host defines the DNS resolvabe hostname for the external cluster.
	// If specified, the cluster's address will be resolved using DNS.
	// HTTP based clusters will set the Host attribute.
	// If unspecified, the cluster's address will be resolved to its original
	// destination in the request prior to being redirected by iptables.
	// TCP based clusters will not set the Host attribute.
	// +optional
	Host string

	// Port defines the port number of the external cluster's endpoint
	Port int

	// UpstreamConnectionSettings are the connection settings for the upstream cluster
	UpstreamConnectionSettings *policyv1alpha1.ConnectionSettingsSpec
}

type EgressHTTPRouteConfig struct {
	// Name defines the name of the Egress HTTP route configuration
	Name string

	// Hostnames defines the list of hostnames corresponding to the Egress HTTP route configuration.
	// The Hostnames match against the :host header in the HTTP request and subject matching requests
	// to the routing rules defined by `RoutingRules`.
	Hostnames []string

	// RoutingRules defines the list of routes for the Egress HTTP route configuration, and corresponding
	// rules to be applied to those routes.
	RoutingRules []*EgressHTTPRoutingRule
}

type EgressHTTPRoutingRule struct {
	// Route defines the HTTP route match and its associated cluster.
	Route RouteWeightedClusters

	// AllowedDestinationIPRanges defines the destination IP ranges allowed for the `Route` defined in the routing rule.
	AllowedDestinationIPRanges []string
}

type EgressTrafficPolicy struct {
	// TrafficMatches defines the list of traffic matches for matching Egress traffic.
	// The matches specified are used to match outbound traffic as Egress traffic, and
	// subject matching traffic to Egress traffic policies.
	TrafficMatches []*TrafficMatch

	// HTTPRouteConfigsPerPort defines the Egress HTTP route configurations per port.
	// Egress HTTP routes are grouped based on their port to avoid route conflicts that
	// can arise when the same host headers are to be routed differently based on the
	// port specified in an egress policy.
	HTTPRouteConfigsPerPort map[int][]*EgressHTTPRouteConfig

	// ClustersConfigs defines the list of Egress cluster configurations.
	// The specified config is used to program external clusters corresponding to
	// the external endpoints defined in an Egress policy.
	ClustersConfigs []*EgressClusterConfig
}

type HTTPRouteMatch struct {
	Path          string            `json:"path:omitempty"`
	PathMatchType PathMatchType     `json:"path_match_type:omitempty"`
	Methods       []string          `json:"methods:omitempty"`
	Headers       map[string]string `json:"headers:omitempty"`
}

type InboundTrafficPolicy struct {
	Name      string   `json:"name:omitempty"`
	Hostnames []string `json:"hostnames"`
	Rules     []*Rule  `json:"rules:omitempty"`

	// RateLimit defines the rate limit settings applied at the virtual_host level
	// for the given set of hostnames (domains) corresponding to the virtual_host
	// +optional
	RateLimit *policyv1alpha1.RateLimitSpec `json:"rate_limit:omitempty"`
}

type IngressTrafficMatch struct {
	Name                     string
	Port                     uint32
	Protocol                 string
	SourceIPRanges           []string
	ServerNames              []string
	SkipClientCertValidation bool
}

type IngressTrafficPolicy struct {
	TrafficMatches    []*IngressTrafficMatch
	HTTPRoutePolicies []*InboundTrafficPolicy
}

type MeshClusterConfig struct {
	// Name is the cluster's name, as referenced in an RDS route or TCP proxy filter
	Name string

	// Service is the MeshService the cluster corresponds to.
	Service service.MeshService

	// Address is the IP address/hostname of this cluster
	// This is set for local (upstream) clusters accepting traffic from a downstream client.
	// +optional
	Address string

	// Port is the port on which this cluster is listening for downstream connections.
	// This is set for local (upstream) clusters accepting traffic from a downstream client.
	// +optional
	Port uint32

	// EnableEnvoyActiveHealthChecks enables Envoy's active health checks for the cluster
	// +optional
	EnableEnvoyActiveHealthChecks bool

	// UpstreamTrafficSetting is the traffic setting for the upstream cluster
	// +optional
	UpstreamTrafficSetting *policyv1alpha1.UpstreamTrafficSetting

	// Protocol to use for the cluster
	// One of http1, http2, h2c
	// +optional
	Protocol string
}

type OutboundTrafficPolicy struct {
	Name      string                   `json:"name:omitempty"`
	Hostnames []string                 `json:"hostnames"`
	Routes    []*RouteWeightedClusters `json:"routes:omitempty"`
}

type PathMatchType int

type RouteWeightedClusters struct {
	HTTPRouteMatch   HTTPRouteMatch                  `json:"http_route_match:omitempty"`
	WeightedClusters mapset.Set                      `json:"weighted_clusters:omitempty"`
	RetryPolicy      *policyv1alpha1.RetryPolicySpec `json:"retry_policy:omitempty"`

	// RateLimit defines the rate limit settings applied at the route level
	// for the given HTTPRouteMatch
	// +optional
	RateLimit *policyv1alpha1.HTTPPerRouteRateLimitSpec `json:"rate_limit:omitempty"`
}

type Rule struct {
	Route RouteWeightedClusters `json:"route:omitempty"`
	// Principals contain the trust domain already while identities do not.
	AllowedPrincipals mapset.Set `json:"allowed_principals:omitempty"`
}

type TCPRouteMatch struct {
	Ports []uint16 `json:"ports:omitempty"`
}

type TrafficMatch struct {
	// DestinationPort defines the destination port number
	DestinationPort int

	// DestinationProtocol defines the protocol served by DestinationPort
	DestinationProtocol string

	// DestinationIPRanges defines the list of destination IP ranges
	// +optional
	DestinationIPRanges []string

	// ServerNames defines the list of server names to be used as SNI when the
	// DestinationProtocol is TLS based, ex. when the DestinationProtocol is 'https'
	// +optional
	ServerNames []string

	// Cluster defines the cluster associated with this TrafficMatch, if possible.
	// A TrafficMatch corresponding to an HTTP based cluster will not make use of
	// this property since the cluster is determined based on the computed routes.
	// A TraficMatch corresponding to a TCP based cluster will make use of this
	// property to associate the match with the corresponding cluster.
	// +optional
	Cluster string

	// Name for the match object
	// +optional
	Name string

	// WeightedClusters is list of weighted clusters that this match should
	// route traffic to. This is used by TCP based mesh clusters.
	// +optional
	WeightedClusters []service.WeightedCluster

	// RateLimit defines the rate limiting policy applied for this TrafficMatch
	// +optional
	RateLimit *policyv1alpha1.RateLimitSpec
}

type TrafficSpecMatchName string

type TrafficSpecName string

type TrafficTargetWithRoutes struct {
	Name            string                     `json:"name:omitempty"`
	Destination     identity.ServiceIdentity   `json:"destination:omitempty"`
	Sources         []identity.ServiceIdentity `json:"sources:omitempty"`
	TCPRouteMatches []TCPRouteMatch            `json:"tcp_route_matches:omitempty"`
}