v1alpha1

type EnvValueSource int32

type EnvVar struct {

	// Name of the environment variable.
	// Must be a C_IDENTIFIER.
	// +kubebuilder:validation:MaxLength=256
	// +kubebuilder:validation:MinLength=1
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Source for the environment variable's value.
	ValueFrom EnvValueSource `` /* 135-byte string literal not displayed */
	// Value for the environment variable.
	// Only applicable if `valueFrom` is `HOST`.
	// Defaults to "".
	// +kubebuilder:validation:MaxLength=2048
	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type FailStrategy int32

type PluginPhase int32

type PluginType int32

type PullPolicy int32

type VmConfig struct {

	// Specifies environment variables to be injected to this VM.
	// Note that if a key does not exist, it will be ignored.
	// +kubebuilder:validation:MaxItems=256
	// +listType=map
	// +listMapKey=name
	Env []*EnvVar `protobuf:"bytes,1,rep,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type WasmPlugin struct {

	// Criteria used to select the specific set of pods/VMs on which
	// this plugin configuration should be applied. If omitted, this
	// configuration will be applied to all workload instances in the same
	// namespace. If the `WasmPlugin` is present in the config root
	// namespace, it will be applied to all applicable workloads in any
	// namespace.
	//
	// At most, only one of the selector or `targetRef` can be set for a given policy.
	Selector *v1beta1.WorkloadSelector `protobuf:"bytes,1,opt,name=selector,proto3" json:"selector,omitempty"`
	// Optional. The `targetRef` specifies the gateway the policy should be
	// applied to. The targeted resource specified will determine which
	// workloads the WasmPlugin applies to. The targeted resource must be
	// a `Gateway` in the group `gateway.networking.k8s.io`. The gateway
	// must be in the same namespace as the policy.
	//
	// If the `targetRef` is not set, the policy is applied as defined by the selector.
	// At most, only one of the selector or `targetRef` can be set for a given policy.
	// Waypoint proxies will not respect selectors even if they match.
	TargetRef *v1beta1.PolicyTargetReference `protobuf:"bytes,15,opt,name=targetRef,proto3" json:"targetRef,omitempty"`
	// URL of a Wasm module or OCI container. If no scheme is present,
	// defaults to `oci://`, referencing an OCI image. Other valid schemes
	// are `file://` for referencing .wasm module files present locally
	// within the proxy container, and `http[s]://` for `.wasm` module files
	// hosted remotely.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:XValidation:message="url must have schema one of [http, https, file, oci]",rule="isURL(self) ? (url(self).getScheme() in [”, 'http', 'https', 'oci', 'file']) : (isURL('http://' + self) && url('http://' +self).getScheme() in [”, 'http', 'https', 'oci', 'file'])"
	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	// SHA256 checksum that will be used to verify Wasm module or OCI container.
	// If the `url` field already references a SHA256 (using the `@sha256:`
	// notation), it must match the value of this field. If an OCI image is
	// referenced by tag and this field is set, its checksum will be verified
	// against the contents of this field after pulling.
	// +kubebuilder:validation:Pattern="(^$|^[a-f0-9]{64}$)"
	Sha256 string `protobuf:"bytes,3,opt,name=sha256,proto3" json:"sha256,omitempty"`
	// The pull behaviour to be applied when fetching Wasm module by either
	// OCI image or `http/https`. Only relevant when referencing Wasm module without
	// any digest, including the digest in OCI image URL or `sha256` field in `vm_config`.
	// Defaults to `IfNotPresent`, except when an OCI image is referenced in the `url`
	// and the `latest` tag is used, in which case `Always` is the default,
	// mirroring Kubernetes behaviour.
	ImagePullPolicy PullPolicy `` /* 151-byte string literal not displayed */
	// Credentials to use for OCI image pulling.
	// Name of a Kubernetes Secret in the same namespace as the `WasmPlugin` that
	// contains a Docker pull secret which is to be used to authenticate
	// against the registry when pulling the image.
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=253
	ImagePullSecret string `protobuf:"bytes,5,opt,name=image_pull_secret,json=imagePullSecret,proto3" json:"image_pull_secret,omitempty"`
	// $hide_from_docs
	// Public key that will be used to verify signatures of signed OCI images
	// or Wasm modules.
	//
	// At this moment, various ways for signing/verifying are emerging and being proposed.
	// We can observe two major streams for signing OCI images: Cosign from Sigstore and Notary,
	// which is used in Docker Content Trust.
	// In case of Wasm module, multiple approaches are still in discussion.
	//   - https://github.com/WebAssembly/design/issues/1413
	//   - https://github.com/wasm-signatures/design (various signing tools are enumerated)
	//
	// In addition, for each method for signing&verifying, we may need to consider to provide
	// additional data or configuration (e.g., key rolling, KMS, root certs, ...) as well.
	//
	// To deal with this situation, we need to elaborate more generic way to describe
	// how to sign and verify the image or wasm binary, and how to specify relevant data,
	// including this `verification_key`.
	//
	// Therefore, this field will not be implemented until the detailed design is established.
	// For the future use, just keep this field in proto and hide from documentation.
	VerificationKey string `protobuf:"bytes,6,opt,name=verification_key,json=verificationKey,proto3" json:"verification_key,omitempty"`
	// The configuration that will be passed on to the plugin.
	PluginConfig *_struct.Struct `protobuf:"bytes,7,opt,name=plugin_config,json=pluginConfig,proto3" json:"plugin_config,omitempty"`
	// The plugin name to be used in the Envoy configuration (used to be called
	// `rootID`). Some .wasm modules might require this value to select the Wasm
	// plugin to execute.
	// +kubebuilder:validation:MaxLength=256
	// +kubebuilder:validation:MinLength=1
	PluginName string `protobuf:"bytes,8,opt,name=plugin_name,json=pluginName,proto3" json:"plugin_name,omitempty"`
	// Determines where in the filter chain this `WasmPlugin` is to be injected.
	Phase PluginPhase `protobuf:"varint,9,opt,name=phase,proto3,enum=istio.extensions.v1alpha1.PluginPhase" json:"phase,omitempty"`
	// Determines ordering of `WasmPlugins` in the same `phase`.
	// When multiple `WasmPlugins` are applied to the same workload in the
	// same `phase`, they will be applied by priority, in descending order.
	// If `priority` is not set, or two `WasmPlugins` exist with the same
	// value, the ordering will be deterministically derived from name and
	// namespace of the `WasmPlugins`. Defaults to `0`.
	Priority *wrappers.Int32Value `protobuf:"bytes,10,opt,name=priority,proto3" json:"priority,omitempty"`
	// Specifies the failure behavior for the plugin due to fatal errors.
	FailStrategy FailStrategy `` /* 143-byte string literal not displayed */
	// Configuration for a Wasm VM.
	// More details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
	VmConfig *VmConfig `protobuf:"bytes,11,opt,name=vm_config,json=vmConfig,proto3" json:"vm_config,omitempty"`
	// Specifies the criteria to determine which traffic is passed to WasmPlugin.
	// If a traffic satisfies any of TrafficSelectors,
	// the traffic passes the WasmPlugin.
	Match []*WasmPlugin_TrafficSelector `protobuf:"bytes,12,rep,name=match,proto3" json:"match,omitempty"`
	// Specifies the type of Wasm Extension to be used.
	Type PluginType `protobuf:"varint,14,opt,name=type,proto3,enum=istio.extensions.v1alpha1.PluginType" json:"type,omitempty"`
	// contains filtered or unexported fields
}

type WasmPlugin_TrafficSelector struct {

	// Criteria for selecting traffic by their direction.
	// Note that `CLIENT` and `SERVER` are analogous to OUTBOUND and INBOUND,
	// respectively.
	// For the gateway, the field should be `CLIENT` or `CLIENT_AND_SERVER`.
	// If not specified, the default value is `CLIENT_AND_SERVER`.
	Mode v1beta1.WorkloadMode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.type.v1beta1.WorkloadMode" json:"mode,omitempty"`
	// Criteria for selecting traffic by their destination port.
	// More specifically, for the outbound traffic, the destination port would be
	// the port of the target service. On the other hand, for the inbound traffic,
	// the destination port is the port bound by the server process in the same Pod.
	//
	// If one of the given `ports` is matched, this condition is evaluated to true.
	// If not specified, this condition is evaluated to true for any port.
	// +listType=map
	// +listMapKey=number
	Ports []*v1beta1.PortSelector `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty"`
	// contains filtered or unexported fields
}