v1alpha1

type AuthenticationPolicy int32

type Certificate struct {

	// Name of the secret the certificate and its key will be stored into.
	// If it is empty, it will not be stored into a secret.
	// Instead, the certificate and its key will be stored into a hard-coded directory.
	SecretName string `protobuf:"bytes,1,opt,name=secret_name,json=secretName,proto3" json:"secret_name,omitempty"`
	// The DNS names for the certificate. A certificate may contain
	// multiple DNS names.
	DnsNames []string `protobuf:"bytes,2,rep,name=dns_names,json=dnsNames,proto3" json:"dns_names,omitempty"`
	// contains filtered or unexported fields
}

type ConfigSource struct {

	// Address of the server implementing the Istio Mesh Configuration
	// protocol (MCP). Can be IP address or a fully qualified DNS name.
	// Use xds:// to specify a grpc-based xds backend, k8s:// to specify a k8s controller or
	// fs:/// to specify a file-based backend with absolute path to the directory.
	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// Use the tls_settings to specify the tls mode to use. If the MCP server
	// uses Istio mutual TLS and shares the root CA with Pilot, specify the TLS
	// mode as `ISTIO_MUTUAL`.
	TlsSettings *v1alpha3.ClientTLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings,proto3" json:"tls_settings,omitempty"`
	// Describes the source of configuration, if nothing is specified default is MCP
	SubscribedResources []Resource `` /* 160-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ForwardClientCertDetails int32

type MeshConfig struct {

	// Port on which Envoy should listen for all outbound traffic to other services.
	// Default port is 15001.
	ProxyListenPort int32 `protobuf:"varint,4,opt,name=proxy_listen_port,json=proxyListenPort,proto3" json:"proxy_listen_port,omitempty"`
	// Port on which Envoy should listen for all inbound traffic to the pod/vm will be captured to.
	// Default port is 15006.
	ProxyInboundListenPort int32 `` /* 133-byte string literal not displayed */
	// Port on which Envoy should listen for HTTP PROXY requests if set.
	ProxyHttpPort int32 `protobuf:"varint,5,opt,name=proxy_http_port,json=proxyHttpPort,proto3" json:"proxy_http_port,omitempty"`
	// Connection timeout used by Envoy. (MUST BE >=1ms)
	// Default timeout is 10s.
	ConnectTimeout *duration.Duration `protobuf:"bytes,6,opt,name=connect_timeout,json=connectTimeout,proto3" json:"connect_timeout,omitempty"`
	// $hide_from_docs
	// Automatic protocol detection uses a set of heuristics to
	// determine whether the connection is using TLS or not (on the
	// server side), as well as the application protocol being used
	// (e.g., http vs tcp). These heuristics rely on the client sending
	// the first bits of data. For server first protocols like MySQL,
	// MongoDB, etc. Envoy will timeout on the protocol detection after
	// the specified period, defaulting to non mTLS plain TCP
	// traffic. Set this field to tweak the period that Envoy will wait
	// for the client to send the first bits of data. (MUST BE >=1ms or
	// 0s to disable). Default detection timeout is 0s (no timeout).
	//
	// Setting a timeout is not recommended nor safe. Even high timeouts (>5s) will be hit
	// occasionally, and when they occur the result is typically broken traffic that may not
	// recover on its own. Exceptionally high values might solve this, but injecting 60s delays
	// onto new connections is generally not tenable anyways.
	ProtocolDetectionTimeout *duration.Duration `` /* 136-byte string literal not displayed */
	// If set then set `SO_KEEPALIVE` on the socket to enable TCP Keepalives.
	TcpKeepalive *v1alpha3.ConnectionPoolSettings_TCPSettings_TcpKeepalive `protobuf:"bytes,28,opt,name=tcp_keepalive,json=tcpKeepalive,proto3" json:"tcp_keepalive,omitempty"`
	// Class of ingress resources to be processed by Istio ingress
	// controller. This corresponds to the value of
	// `kubernetes.io/ingress.class` annotation.
	IngressClass string `protobuf:"bytes,7,opt,name=ingress_class,json=ingressClass,proto3" json:"ingress_class,omitempty"`
	// Name of the Kubernetes service used for the istio ingress controller.
	// If no ingress controller is specified, the default value `istio-ingressgateway` is used.
	IngressService string `protobuf:"bytes,8,opt,name=ingress_service,json=ingressService,proto3" json:"ingress_service,omitempty"`
	// Defines whether to use Istio ingress controller for annotated or all ingress resources.
	// Default mode is `STRICT`.
	IngressControllerMode MeshConfig_IngressControllerMode `` /* 185-byte string literal not displayed */
	// Defines which gateway deployment to use as the Ingress controller. This field corresponds to
	// the Gateway.selector field, and will be set as `istio: INGRESS_SELECTOR`.
	// By default, `ingressgateway` is used, which will select the default IngressGateway as it has the
	// `istio: ingressgateway` labels.
	// It is recommended that this is the same value as ingress_service.
	IngressSelector string `protobuf:"bytes,52,opt,name=ingress_selector,json=ingressSelector,proto3" json:"ingress_selector,omitempty"`
	// Flag to control generation of trace spans and request IDs.
	// Requires a trace span collector defined in the proxy configuration.
	EnableTracing bool `protobuf:"varint,12,opt,name=enable_tracing,json=enableTracing,proto3" json:"enable_tracing,omitempty"`
	// File address for the proxy access log (e.g. /dev/stdout).
	// Empty value disables access logging.
	AccessLogFile string `protobuf:"bytes,13,opt,name=access_log_file,json=accessLogFile,proto3" json:"access_log_file,omitempty"`
	// Format for the proxy access log
	// Empty value results in proxy's default access log format
	AccessLogFormat string `protobuf:"bytes,24,opt,name=access_log_format,json=accessLogFormat,proto3" json:"access_log_format,omitempty"`
	// Encoding for the proxy access log (`TEXT` or `JSON`).
	// Default value is `TEXT`.
	AccessLogEncoding MeshConfig_AccessLogEncoding `` /* 170-byte string literal not displayed */
	// This flag enables Envoy's gRPC Access Log Service.
	// See [Access Log Service](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/access_loggers/grpc/v3/als.proto)
	// for details about Envoy's gRPC Access Log Service API.
	// Default value is `false`.
	EnableEnvoyAccessLogService bool `` /* 150-byte string literal not displayed */
	// This flag disables Envoy Listener logs.
	// See [Listener Access Log](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-access-log)
	// Istio Enables Envoy's listener access logs on "NoRoute" response flag.
	// Default value is `false`.
	DisableEnvoyListenerLog bool `` /* 136-byte string literal not displayed */
	// Default proxy config used by gateway and sidecars.
	// In case of Kubernetes, the proxy config is applied once during the injection process,
	// and remain constant for the duration of the pod. The rest of the mesh config can be changed
	// at runtime and config gets distributed dynamically.
	// On Kubernetes, this can be overridden on individual pods with the `proxy.istio.io/config` annotation.
	DefaultConfig *ProxyConfig `protobuf:"bytes,14,opt,name=default_config,json=defaultConfig,proto3" json:"default_config,omitempty"`
	// Set the default behavior of the sidecar for handling outbound
	// traffic from the application.  If your application uses one or
	// more external services that are not known apriori, setting the
	// policy to `ALLOW_ANY` will cause the sidecars to route any unknown
	// traffic originating from the application to its requested
	// destination. Users are strongly encouraged to use ServiceEntries
	// to explicitly declare any external dependencies, instead of using
	// `ALLOW_ANY`, so that traffic to these services can be
	// monitored. Can be overridden at a Sidecar level by setting the
	// `OutboundTrafficPolicy` in the [Sidecar
	// API](https://istio.io/docs/reference/config/networking/sidecar/#OutboundTrafficPolicy).
	// Default mode is `ALLOW_ANY` which means outbound traffic to unknown destinations will be allowed.
	OutboundTrafficPolicy *MeshConfig_OutboundTrafficPolicy `` /* 127-byte string literal not displayed */
	// ConfigSource describes a source of configuration data for networking
	// rules, and other Istio configuration artifacts. Multiple data sources
	// can be configured for a single control plane.
	ConfigSources []*ConfigSource `protobuf:"bytes,22,rep,name=config_sources,json=configSources,proto3" json:"config_sources,omitempty"`
	// This flag is used to enable mutual `TLS` automatically for service to service communication
	// within the mesh, default true.
	// If set to true, and a given service does not have a corresponding `DestinationRule` configured,
	// or its `DestinationRule` does not have ClientTLSSettings specified, Istio configures client side
	// TLS configuration appropriately. More specifically,
	// If the upstream authentication policy is in `STRICT` mode, use Istio provisioned certificate
	// for mutual `TLS` to connect to upstream.
	// If upstream service is in plain text mode, use plain text.
	// If the upstream authentication policy is in PERMISSIVE mode, Istio configures clients to use
	// mutual `TLS` when server sides are capable of accepting mutual `TLS` traffic.
	// If service `DestinationRule` exists and has `ClientTLSSettings` specified, that is always used instead.
	EnableAutoMtls *wrappers.BoolValue `protobuf:"bytes,43,opt,name=enable_auto_mtls,json=enableAutoMtls,proto3" json:"enable_auto_mtls,omitempty"`
	// The trust domain corresponds to the trust root of a system.
	// Refer to [SPIFFE-ID](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain)
	TrustDomain string `protobuf:"bytes,26,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
	// The trust domain aliases represent the aliases of `trust_domain`.
	// For example, if we have
	// “`yaml
	// trustDomain: td1
	// trustDomainAliases: ["td2", "td3"]
	// “`
	// Any service with the identity `td1/ns/foo/sa/a-service-account`, `td2/ns/foo/sa/a-service-account`,
	// or `td3/ns/foo/sa/a-service-account` will be treated the same in the Istio mesh.
	TrustDomainAliases []string `protobuf:"bytes,46,rep,name=trust_domain_aliases,json=trustDomainAliases,proto3" json:"trust_domain_aliases,omitempty"`
	// The extra root certificates for workload-to-workload communication.
	// The plugin certificates (the 'cacerts' secret) or self-signed certificates (the 'istio-ca-secret' secret)
	// are automatically added by Istiod.
	// The CA certificate that signs the workload certificates is automatically added by Istio Agent.
	CaCertificates []*MeshConfig_CertificateData `protobuf:"bytes,58,rep,name=ca_certificates,json=caCertificates,proto3" json:"ca_certificates,omitempty"`
	// The default value for the ServiceEntry.export_to field and services
	// imported through container registry integrations, e.g. this applies to
	// Kubernetes Service resources. The value is a list of namespace names and
	// reserved namespace aliases. The allowed namespace aliases are:
	// “`
	// * - All Namespaces
	// . - Current Namespace
	// ~ - No Namespace
	// “`
	// If not set the system will use "*" as the default value which implies that
	// services are exported to all namespaces.
	//
	// `All namespaces` is a reasonable default for implementations that don't
	// need to restrict access or visibility of services across namespace
	// boundaries. If that requirement is present it is generally good practice to
	// make the default `Current namespace` so that services are only visible
	// within their own namespaces by default. Operators can then expand the
	// visibility of services to other namespaces as needed. Use of `No Namespace`
	// is expected to be rare but can have utility for deployments where
	// dependency management needs to be precise even within the scope of a single
	// namespace.
	//
	// For further discussion see the reference documentation for `ServiceEntry`,
	// `Sidecar`, and `Gateway`.
	DefaultServiceExportTo []string `` /* 132-byte string literal not displayed */
	// The default value for the VirtualService.export_to field. Has the same
	// syntax as `default_service_export_to`.
	//
	// If not set the system will use "*" as the default value which implies that
	// virtual services are exported to all namespaces
	DefaultVirtualServiceExportTo []string `` /* 155-byte string literal not displayed */
	// The default value for the `DestinationRule.export_to` field. Has the same
	// syntax as `default_service_export_to`.
	//
	// If not set the system will use "*" as the default value which implies that
	// destination rules are exported to all namespaces
	DefaultDestinationRuleExportTo []string `` /* 158-byte string literal not displayed */
	// The namespace to treat as the administrative root namespace for
	// Istio configuration. When processing a leaf namespace Istio will search for
	// declarations in that namespace first and if none are found it will
	// search in the root namespace. Any matching declaration found in the root
	// namespace is processed as if it were declared in the leaf namespace.
	//
	// The precise semantics of this processing are documented on each resource
	// type.
	RootNamespace string `protobuf:"bytes,34,opt,name=root_namespace,json=rootNamespace,proto3" json:"root_namespace,omitempty"`
	// Locality based load balancing distribution or failover settings.
	// If unspecified, locality based load balancing will be enabled by default.
	// However, this requires outlierDetection to actually take effect for a particular
	// service, see https://istio.io/latest/docs/tasks/traffic-management/locality-load-balancing/failover/
	LocalityLbSetting *v1alpha3.LocalityLoadBalancerSetting `protobuf:"bytes,35,opt,name=locality_lb_setting,json=localityLbSetting,proto3" json:"locality_lb_setting,omitempty"`
	// Configures DNS refresh rate for Envoy clusters of type `STRICT_DNS`
	// Default refresh rate is `60s`.
	DnsRefreshRate *duration.Duration `protobuf:"bytes,36,opt,name=dns_refresh_rate,json=dnsRefreshRate,proto3" json:"dns_refresh_rate,omitempty"`
	// Specify if http1.1 connections should be upgraded to http2 by default.
	// if sidecar is installed on all pods in the mesh, then this should be set to `UPGRADE`.
	// If one or more services or namespaces do not have sidecar(s), then this should be set to `DO_NOT_UPGRADE`.
	// It can be enabled by destination using the `destinationRule.trafficPolicy.connectionPool.http.h2UpgradePolicy` override.
	H2UpgradePolicy MeshConfig_H2UpgradePolicy `` /* 162-byte string literal not displayed */
	// Name to be used while emitting statistics for inbound clusters. The same pattern is used while computing stat prefix for
	// network filters like TCP and Redis.
	// By default, Istio emits statistics with the pattern `inbound|<port>|<port-name>|<service-FQDN>`.
	// For example `inbound|7443|grpc-reviews|reviews.prod.svc.cluster.local`. This can be used to override that pattern.
	//
	// A Pattern can be composed of various pre-defined variables. The following variables are supported.
	//
	// - `%SERVICE%` - Will be substituted with name of the service.
	// - `%SERVICE_FQDN%` - Will be substituted with FQDN of the service.
	// - `%SERVICE_PORT%` - Will be substituted with port of the service.
	// - `%TARGET_PORT%`  - Will be substituted with the target port of the service.
	// - `%SERVICE_PORT_NAME%` - Will be substituted with port name of the service.
	//
	// Following are some examples of supported patterns for reviews:
	//
	// - `%SERVICE_FQDN%_%SERVICE_PORT%` will use reviews.prod.svc.cluster.local_7443 as the stats name.
	// - `%SERVICE%` will use reviews.prod as the stats name.
	InboundClusterStatName string `` /* 132-byte string literal not displayed */
	// Name to be used while emitting statistics for outbound clusters. The same pattern is used while computing stat prefix for
	// network filters like TCP and Redis.
	// By default, Istio emits statistics with the pattern `outbound|<port>|<subsetname>|<service-FQDN>`.
	// For example `outbound|8080|v2|reviews.prod.svc.cluster.local`. This can be used to override that pattern.
	//
	// A Pattern can be composed of various pre-defined variables. The following variables are supported.
	//
	// - `%SERVICE%` - Will be substituted with name of the service.
	// - `%SERVICE_FQDN%` - Will be substituted with FQDN of the service.
	// - `%SERVICE_PORT%` - Will be substituted with port of the service.
	// - `%SERVICE_PORT_NAME%` - Will be substituted with port name of the service.
	// - `%SUBSET_NAME%` - Will be substituted with subset.
	//
	// Following are some examples of supported patterns for reviews:
	//
	// - `%SERVICE_FQDN%_%SERVICE_PORT%` will use `reviews.prod.svc.cluster.local_7443` as the stats name.
	// - `%SERVICE%` will use reviews.prod as the stats name.
	OutboundClusterStatName string `` /* 135-byte string literal not displayed */
	// $hide_from_docs
	// Configure the provision of certificates.
	//
	// Note: Deprecated, please refer to Cert-Manager or other cert provisioning solutions to sign DNS certificates.
	Certificates []*Certificate `protobuf:"bytes,47,rep,name=certificates,proto3" json:"certificates,omitempty"`
	// $hide_from_docs
	// Settings to be applied to select services.
	ServiceSettings []*MeshConfig_ServiceSettings `protobuf:"bytes,50,rep,name=service_settings,json=serviceSettings,proto3" json:"service_settings,omitempty"`
	// If enabled, Istio agent will merge metrics exposed by the application with metrics from Envoy
	// and Istio agent. The sidecar injection will replace `prometheus.io` annotations present on the pod
	// and redirect them towards Istio agent, which will then merge metrics of from the application with Istio metrics.
	// This relies on the annotations `prometheus.io/scrape`, `prometheus.io/port`, and
	// `prometheus.io/path` annotations.
	// If you are running a separately managed Envoy with an Istio sidecar, this may cause issues, as the metrics will collide.
	// In this case, it is recommended to disable aggregation on that deployment with the
	// `prometheus.istio.io/merge-metrics: "false"` annotation.
	// If not specified, this will be enabled by default.
	EnablePrometheusMerge *wrappers.BoolValue `` /* 127-byte string literal not displayed */
	// $hide_from_docs
	// `VerifyCertificateAtClient` sets the mesh global default for peer certificate validation
	// at the client-side proxy when `SIMPLE` TLS or `MUTUAL` TLS (non `ISTIO_MUTUAL`) origination
	// modes are used. This setting can be overridden at the host level via DestinationRule API.
	// By default, `VerifyCertificateAtClient` is `true`.
	//
	// `CaCertificates`: If set, proxy verifies CA signature based on given CaCertificates. If unset,
	// and VerifyCertificateAtClient is true, proxy uses default System CA bundle. If unset and
	// `VerifyCertificateAtClient` is false, proxy will not verify the CA.
	//
	// `SubjectAltNames`: If set, proxy verifies subject alt names are present in the SAN. If unset,
	// and `VerifyCertificateAtClient` is true, proxy uses host in destination rule to verify the SANs.
	// If unset, and `VerifyCertificateAtClient` is false, proxy does not verify SANs.
	//
	// For SAN, client-side proxy will exact match host in `DestinationRule` as well as one level
	// wildcard if the specified host in DestinationRule doesn't contain a wildcard.
	// For example, if the host in `DestinationRule` is `x.y.com`, client-side proxy will
	// match either `x.y.com` or `*.y.com` for the SAN in the presented server certificate.
	// For wildcard host name in DestinationRule, client-side proxy will do a suffix match. For example,
	// if host is `*.x.y.com`, client-side proxy will verify the presented server certificate SAN matches
	// “.x.y.com` suffix.
	//
	// Deprecated: Marked as deprecated in mesh/v1alpha1/config.proto.
	VerifyCertificateAtClient *wrappers.BoolValue `` /* 141-byte string literal not displayed */
	// $hide_from_docs
	// If specified, Istiod will authorize and forward the CSRs from the workloads to the specified external CA
	// using the Istio CA gRPC API.
	Ca *MeshConfig_CA `protobuf:"bytes,55,opt,name=ca,proto3" json:"ca,omitempty"`
	// Defines a list of extension providers that extend Istio's functionality. For example, the AuthorizationPolicy
	// can be used with an extension provider to delegate the authorization decision to a custom authorization system.
	ExtensionProviders []*MeshConfig_ExtensionProvider `protobuf:"bytes,57,rep,name=extension_providers,json=extensionProviders,proto3" json:"extension_providers,omitempty"`
	// Specifies extension providers to use by default in Istio configuration resources.
	DefaultProviders *MeshConfig_DefaultProviders `protobuf:"bytes,60,opt,name=default_providers,json=defaultProviders,proto3" json:"default_providers,omitempty"`
	// A list of Kubernetes selectors that specify the set of namespaces that Istio considers when
	// computing configuration updates for sidecars. This can be used to reduce Istio's computational load
	// by limiting the number of entities (including services, pods, and endpoints) that are watched and processed.
	// If omitted, Istio will use the default behavior of processing all namespaces in the cluster.
	// Elements in the list are disjunctive (OR semantics), i.e. a namespace will be included if it matches any selector.
	// The following example selects any namespace that matches either below:
	// 1. The namespace has both of these labels: `env: prod` and `region: us-east1`
	// 2. The namespace has label `app` equal to `cassandra` or `spark`.
	// “`yaml
	// discoverySelectors:
	//   - matchLabels:
	//     env: prod
	//     region: us-east1
	//   - matchExpressions:
	//   - key: app
	//     operator: In
	//     values:
	//   - cassandra
	//   - spark
	//
	// “`
	// Refer to the [Kubernetes selector docs](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors)
	// for additional detail on selector semantics.
	DiscoverySelectors []*v1.LabelSelector `protobuf:"bytes,59,rep,name=discovery_selectors,json=discoverySelectors,proto3" json:"discovery_selectors,omitempty"`
	// ProxyPathNormalization configures how URL paths in incoming and outgoing HTTP requests are
	// normalized by the sidecars and gateways.
	// The normalized paths will be used in all aspects through the requests' lifetime on the
	// sidecars and gateways, which includes routing decisions in outbound direction (client proxy),
	// authorization policy match and enforcement in inbound direction (server proxy), and the URL
	// path proxied to the upstream service.
	// If not set, the NormalizationType.DEFAULT configuration will be used.
	PathNormalization *MeshConfig_ProxyPathNormalization `protobuf:"bytes,61,opt,name=path_normalization,json=pathNormalization,proto3" json:"path_normalization,omitempty"`
	// Configure the default HTTP retry policy.
	// The default number of retry attempts is set at 2 for these errors:
	//
	//	"connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes".
	//
	// Setting the number of attempts to 0 disables retry policy globally.
	// This setting can be overridden on a per-host basis using the Virtual Service
	// API.
	// All settings in the retry policy except `perTryTimeout` can currently be
	// configured globally via this field.
	DefaultHttpRetryPolicy *v1alpha3.HTTPRetry `` /* 132-byte string literal not displayed */
	// The below configuration parameters can be used to specify TLSConfig for mesh traffic.
	// For example, a user could enable min TLS version for ISTIO_MUTUAL traffic and specify a curve for non ISTIO_MUTUAL traffic like below:
	// “`yaml
	// meshConfig:
	//
	//	meshMTLS:
	//	  minProtocolVersion: TLSV1_3
	//	tlsDefaults:
	//	  Note: applicable only for non ISTIO_MUTUAL scenarios
	//	  ecdhCurves:
	//	    - P-256
	//	    - P-512
	//
	// “`
	// Configuration of mTLS for traffic between workloads with ISTIO_MUTUAL TLS traffic.
	//
	// Note: Mesh mTLS does not respect ECDH curves.
	MeshMTLS *MeshConfig_TLSConfig `protobuf:"bytes,63,opt,name=mesh_mTLS,json=meshMTLS,proto3" json:"mesh_mTLS,omitempty"`
	// Configuration of TLS for all traffic except for ISTIO_MUTUAL mode.
	// Currently, this supports configuration of ecdh_curves and cipher_suites only.
	// For ISTIO_MUTUAL TLS settings, use meshMTLS configuration.
	TlsDefaults *MeshConfig_TLSConfig `protobuf:"bytes,64,opt,name=tls_defaults,json=tlsDefaults,proto3" json:"tls_defaults,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_AccessLogEncoding int32

type MeshConfig_AuthPolicy int32

type MeshConfig_CA struct {

	// REQUIRED. Address of the CA server implementing the Istio CA gRPC API.
	// Can be IP address or a fully qualified DNS name with port
	// Eg: custom-ca.default.svc.cluster.local:8932, 192.168.23.2:9000
	Address string `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
	// Use the tls_settings to specify the tls mode to use.
	// Regarding tls_settings:
	// - DISABLE MODE is legitimate for the case Istiod is making the request via an Envoy sidecar.
	// DISABLE MODE can also be used for testing
	// - TLS MUTUAL MODE be on by default. If the CA certificates
	// (cert bundle to verify the CA server's certificate) is omitted, Istiod will
	// use the system root certs to verify the CA server's certificate.
	TlsSettings *v1alpha3.ClientTLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings,proto3" json:"tls_settings,omitempty"`
	// timeout for forward CSR requests from Istiod to External CA
	// Default: 10s
	RequestTimeout *duration.Duration `protobuf:"bytes,3,opt,name=request_timeout,json=requestTimeout,proto3" json:"request_timeout,omitempty"`
	// Use istiod_side to specify CA Server integrate to Istiod side or Agent side
	// Default: true
	IstiodSide bool `protobuf:"varint,4,opt,name=istiod_side,json=istiodSide,proto3" json:"istiod_side,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_CertificateData struct {

	// Types that are assignable to CertificateData:
	//
	//	*MeshConfig_CertificateData_Pem
	//	*MeshConfig_CertificateData_SpiffeBundleUrl
	CertificateData isMeshConfig_CertificateData_CertificateData `protobuf_oneof:"certificate_data"`
	// Optional. Specify the kubernetes signers (External CA) that use this trustAnchor
	// when Istiod is acting as RA(registration authority)
	// If set, they are used for these signers. Otherwise, this trustAnchor is used for all signers.
	CertSigners []string `protobuf:"bytes,3,rep,name=cert_signers,json=certSigners,proto3" json:"cert_signers,omitempty"`
	// Optional. Specify the list of trust domains to which this trustAnchor data belongs.
	// If set, they are used for these trust domains. Otherwise, this trustAnchor is used for default trust domain
	// and its aliases.
	// Note that we can have multiple trustAnchor data for a same trust_domain.
	// In that case, trustAnchors with a same trust domain will be merged and used together to verify peer certificates.
	// If neither cert_signers nor trust_domains is set, this trustAnchor is used for all trust domains and all signers.
	// If only trust_domains is set, this trustAnchor is used for these trust_domains and all signers.
	// If only cert_signers is set, this trustAnchor is used for these cert_signers and all trust domains.
	// If both cert_signers and trust_domains is set, this trustAnchor is only used for these signers and trust domains.
	TrustDomains []string `protobuf:"bytes,4,rep,name=trust_domains,json=trustDomains,proto3" json:"trust_domains,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_CertificateData_Pem struct {
	// The PEM data of the certificate.
	Pem string `protobuf:"bytes,1,opt,name=pem,proto3,oneof"`
}

type MeshConfig_CertificateData_SpiffeBundleUrl struct {
	// The SPIFFE bundle endpoint URL that complies to:
	// https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE_Trust_Domain_and_Bundle.md#the-spiffe-trust-domain-and-bundle
	// The endpoint should support authentication based on Web PKI:
	// https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE_Trust_Domain_and_Bundle.md#521-web-pki
	// The certificate is retrieved from the endpoint.
	SpiffeBundleUrl string `protobuf:"bytes,2,opt,name=spiffe_bundle_url,json=spiffeBundleUrl,proto3,oneof"`
}

type MeshConfig_DefaultProviders struct {

	// Name of the default provider(s) for tracing.
	Tracing []string `protobuf:"bytes,1,rep,name=tracing,proto3" json:"tracing,omitempty"`
	// Name of the default provider(s) for metrics.
	Metrics []string `protobuf:"bytes,2,rep,name=metrics,proto3" json:"metrics,omitempty"`
	// Name of the default provider(s) for access logging.
	AccessLogging []string `protobuf:"bytes,3,rep,name=access_logging,json=accessLogging,proto3" json:"access_logging,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider struct {

	// REQUIRED. A unique name identifying the extension provider.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// REQUIRED. Specifies detailed configuration for the extension provider.
	//
	// Types that are assignable to Provider:
	//
	//	*MeshConfig_ExtensionProvider_EnvoyExtAuthzHttp
	//	*MeshConfig_ExtensionProvider_EnvoyExtAuthzGrpc
	//	*MeshConfig_ExtensionProvider_Zipkin
	//	*MeshConfig_ExtensionProvider_Lightstep
	//	*MeshConfig_ExtensionProvider_Datadog
	//	*MeshConfig_ExtensionProvider_Stackdriver
	//	*MeshConfig_ExtensionProvider_Opencensus
	//	*MeshConfig_ExtensionProvider_Skywalking
	//	*MeshConfig_ExtensionProvider_Opentelemetry
	//	*MeshConfig_ExtensionProvider_Prometheus
	//	*MeshConfig_ExtensionProvider_EnvoyFileAccessLog
	//	*MeshConfig_ExtensionProvider_EnvoyHttpAls
	//	*MeshConfig_ExtensionProvider_EnvoyTcpAls
	//	*MeshConfig_ExtensionProvider_EnvoyOtelAls
	Provider isMeshConfig_ExtensionProvider_Provider `protobuf_oneof:"provider"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_Datadog struct {
	// Configures a Datadog tracing provider.
	Datadog *MeshConfig_ExtensionProvider_DatadogTracingProvider `protobuf:"bytes,6,opt,name=datadog,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_DatadogTracingProvider struct {

	// REQUIRED. Specifies the service for the Datadog agent.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "datadog.default.svc.cluster.local" or "bar/datadog.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. Controls the overall path length allowed in a reported span.
	// NOTE: currently only controls max length of the path tag.
	MaxTagLength uint32 `protobuf:"varint,3,opt,name=max_tag_length,json=maxTagLength,proto3" json:"max_tag_length,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyExtAuthzGrpc struct {
	// Configures an external authorizer that implements the Envoy ext_authz filter authorization check service using the gRPC API.
	EnvoyExtAuthzGrpc *MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationGrpcProvider `protobuf:"bytes,3,opt,name=envoy_ext_authz_grpc,json=envoyExtAuthzGrpc,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyExtAuthzHttp struct {
	// Configures an external authorizer that implements the Envoy ext_authz filter authorization check service using the HTTP API.
	EnvoyExtAuthzHttp *MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationHttpProvider `protobuf:"bytes,2,opt,name=envoy_ext_authz_http,json=envoyExtAuthzHttp,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationGrpcProvider struct {

	// REQUIRED. Specifies the service that implements the Envoy ext_authz gRPC authorization service.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "my-ext-authz.foo.svc.cluster.local" or "bar/my-ext-authz.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// The maximum duration that the proxy will wait for a response from the provider, this is the timeout for a specific request (default timeout: 600s).
	// When this timeout condition is met, the proxy marks the communication to the authorization service as failure.
	// In this situation, the response sent back to the client will depend on the configured `fail_open` field.
	Timeout *duration.Duration `protobuf:"bytes,5,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// If true, the HTTP request or TCP connection will be allowed even if the communication with the authorization service has failed,
	// or if the authorization service has returned a HTTP 5xx error.
	// Default is false. For HTTP request, it will be rejected with 403 (HTTP Forbidden). For TCP connection, it will be closed immediately.
	FailOpen bool `protobuf:"varint,3,opt,name=fail_open,json=failOpen,proto3" json:"fail_open,omitempty"`
	// Sets the HTTP status that is returned to the client when there is a network error to the authorization service.
	// The default status is "403" (HTTP Forbidden).
	StatusOnError string `protobuf:"bytes,4,opt,name=status_on_error,json=statusOnError,proto3" json:"status_on_error,omitempty"`
	// If set, the client request body will be included in the authorization request sent to the authorization service.
	IncludeRequestBodyInCheck *MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationRequestBody `` /* 142-byte string literal not displayed */
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationHttpProvider struct {

	// REQUIRED. Specifies the service that implements the Envoy ext_authz HTTP authorization service.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "my-ext-authz.foo.svc.cluster.local" or "bar/my-ext-authz.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// The maximum duration that the proxy will wait for a response from the provider (default timeout: 600s).
	// When this timeout condition is met, the proxy marks the communication to the authorization service as failure.
	// In this situation, the response sent back to the client will depend on the configured `fail_open` field.
	Timeout *duration.Duration `protobuf:"bytes,9,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// Sets a prefix to the value of authorization request header *Path*.
	// For example, setting this to "/check" for an original user request at path "/admin" will cause the
	// authorization check request to be sent to the authorization service at the path "/check/admin" instead of "/admin".
	PathPrefix string `protobuf:"bytes,3,opt,name=path_prefix,json=pathPrefix,proto3" json:"path_prefix,omitempty"`
	// If true, the user request will be allowed even if the communication with the authorization service has failed,
	// or if the authorization service has returned a HTTP 5xx error.
	// Default is false and the request will be rejected with "Forbidden" response.
	FailOpen bool `protobuf:"varint,4,opt,name=fail_open,json=failOpen,proto3" json:"fail_open,omitempty"`
	// Sets the HTTP status that is returned to the client when there is a network error to the authorization service.
	// The default status is "403" (HTTP Forbidden).
	StatusOnError string `protobuf:"bytes,5,opt,name=status_on_error,json=statusOnError,proto3" json:"status_on_error,omitempty"`
	// DEPRECATED. Use include_request_headers_in_check instead.
	IncludeHeadersInCheck []string `` /* 128-byte string literal not displayed */
	// List of client request headers that should be included in the authorization request sent to the authorization service.
	// Note that in addition to the headers specified here following headers are included by default:
	// 1. *Host*, *Method*, *Path* and *Content-Length* are automatically sent.
	// 2. *Content-Length* will be set to 0 and the request will not have a message body. However, the authorization
	// request can include the buffered client request body (controlled by include_request_body_in_check setting),
	// consequently the value of Content-Length of the authorization request reflects the size of its payload size.
	//
	// Exact, prefix and suffix matches are supported (similar to the
	// [authorization policy rule syntax](https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule)
	// except the presence match):
	// - Exact match: "abc" will match on value "abc".
	// - Prefix match: "abc*" will match on value "abc" and "abcd".
	// - Suffix match: "*abc" will match on value "abc" and "xabc".
	IncludeRequestHeadersInCheck []string `` /* 152-byte string literal not displayed */
	// Set of additional fixed headers that should be included in the authorization request sent to the authorization service.
	// Key is the header name and value is the header value.
	// Note that client request of the same key or headers specified in include_request_headers_in_check will be overridden.
	IncludeAdditionalHeadersInCheck map[string]string `` /* 249-byte string literal not displayed */
	// If set, the client request body will be included in the authorization request sent to the authorization service.
	IncludeRequestBodyInCheck *MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationRequestBody `` /* 143-byte string literal not displayed */
	// List of headers from the authorization service that should be added or overridden in the original request and
	// forwarded to the upstream when the authorization check result is allowed (HTTP code 200).
	// If not specified, the original request will not be modified and forwarded to backend as-is.
	// Note, any existing headers will be overridden.
	//
	// Exact, prefix and suffix matches are supported (similar to the
	// [authorization policy rule syntax](https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule)
	// except the presence match):
	// - Exact match: "abc" will match on value "abc".
	// - Prefix match: "abc*" will match on value "abc" and "abcd".
	// - Suffix match: "*abc" will match on value "abc" and "xabc".
	HeadersToUpstreamOnAllow []string `` /* 139-byte string literal not displayed */
	// List of headers from the authorization service that should be forwarded to downstream when the authorization
	// check result is not allowed (HTTP code other than 200).
	// If not specified, all the authorization response headers, except *Authority (Host)* will be in the response to
	// the downstream.
	// When a header is included in this list, *Path*, *Status*, *Content-Length*, *WWWAuthenticate* and *Location* are
	// automatically added.
	// Note, the body from the authorization service is always included in the response to downstream.
	//
	// Exact, prefix and suffix matches are supported (similar to the
	// [authorization policy rule syntax](https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule)
	// except the presence match):
	// - Exact match: "abc" will match on value "abc".
	// - Prefix match: "abc*" will match on value "abc" and "abcd".
	// - Suffix match: "*abc" will match on value "abc" and "xabc".
	HeadersToDownstreamOnDeny []string `` /* 142-byte string literal not displayed */
	// List of headers from the authorization service that should be forwarded to downstream when the authorization
	// check result is allowed (HTTP code 200).
	// If not specified, the original response will not be modified and forwarded to downstream as-is.
	// Note, any existing headers will be overridden.
	//
	// Exact, prefix and suffix matches are supported (similar to the
	// [authorization policy rule syntax](https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule)
	// except the presence match):
	// - Exact match: "abc" will match on value "abc".
	// - Prefix match: "abc*" will match on value "abc" and "abcd".
	// - Suffix match: "*abc" will match on value "abc" and "xabc".
	HeadersToDownstreamOnAllow []string `` /* 146-byte string literal not displayed */
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationRequestBody struct {

	// Sets the maximum size of a message body that the ext-authz filter will hold in memory.
	// If max_request_bytes is reached, and allow_partial_message is false, Envoy will return a 413 (Payload Too Large).
	// Otherwise the request will be sent to the provider with a partial message.
	// Note that this setting will have precedence over the fail_open field, the 413 will be returned even when the
	// fail_open is set to true.
	MaxRequestBytes uint32 `protobuf:"varint,1,opt,name=max_request_bytes,json=maxRequestBytes,proto3" json:"max_request_bytes,omitempty"`
	// When this field is true, ext-authz filter will buffer the message until max_request_bytes is reached.
	// The authorization request will be dispatched and no 413 HTTP error will be returned by the filter.
	// A "x-envoy-auth-partial-body: false|true" metadata header will be added to the authorization request message
	// indicating if the body data is partial.
	AllowPartialMessage bool `protobuf:"varint,2,opt,name=allow_partial_message,json=allowPartialMessage,proto3" json:"allow_partial_message,omitempty"`
	// If true, the body sent to the external authorization service in the gRPC authorization request is set with raw bytes
	// in the [raw_body field](https://github.com/envoyproxy/envoy/blame/cffb095d59d7935abda12b9509bcd136808367bb/api/envoy/service/auth/v3/attribute_context.proto#L153).
	// Otherwise, it will be filled with UTF-8 string in the [body field](https://github.com/envoyproxy/envoy/blame/cffb095d59d7935abda12b9509bcd136808367bb/api/envoy/service/auth/v3/attribute_context.proto#L147).
	// This field only works with the envoy_ext_authz_grpc provider and has no effect for the envoy_ext_authz_http provider.
	PackAsBytes bool `protobuf:"varint,3,opt,name=pack_as_bytes,json=packAsBytes,proto3" json:"pack_as_bytes,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyFileAccessLog struct {
	// Configures an Envoy File Access Log provider.
	EnvoyFileAccessLog *MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider `protobuf:"bytes,11,opt,name=envoy_file_access_log,json=envoyFileAccessLog,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider struct {

	// Path to a local file to write the access log entries.
	// This may be used to write to streams, via `/dev/stderr` and `/dev/stdout`
	// If unspecified, defaults to `/dev/stdout`.
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// Optional. Allows overriding of the default access log format.
	LogFormat *MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat `protobuf:"bytes,2,opt,name=log_format,json=logFormat,proto3" json:"log_format,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat struct {

	// Types that are assignable to LogFormat:
	//
	//	*MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat_Text
	//	*MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat_Labels
	LogFormat isMeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat_LogFormat `protobuf_oneof:"log_format"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat_Labels struct {
	// JSON structured format for the envoy access logs. Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
	// can be used as values for fields within the Struct. Values are rendered
	// as strings, numbers, or boolean values, as appropriate
	// (see: [format dictionaries](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-dictionaries)). Nested JSON is
	// supported for some command operators (e.g. `FILTER_STATE` or `DYNAMIC_METADATA`).
	// Use `labels: {}` for default envoy JSON log format.
	//
	// Example:
	// “`
	// labels:
	//
	//	status: "%RESPONSE_CODE%"
	//	message: "%LOCAL_REPLY_BODY%"
	//
	// “`
	Labels *_struct.Struct `protobuf:"bytes,2,opt,name=labels,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider_LogFormat_Text struct {
	// Textual format for the envoy access logs. Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be
	// used in the format. The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings)
	// provides more information.
	//
	// NOTE: Istio will insert a newline ('\n') on all formats (if missing).
	//
	// Example: `text: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%"`
	Text string `protobuf:"bytes,1,opt,name=text,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyHttpAls struct {
	// Configures an Envoy Access Logging Service provider for HTTP traffic.
	EnvoyHttpAls *MeshConfig_ExtensionProvider_EnvoyHttpGrpcV3LogProvider `protobuf:"bytes,12,opt,name=envoy_http_als,json=envoyHttpAls,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyHttpGrpcV3LogProvider struct {

	// REQUIRED. Specifies the service that implements the Envoy ALS gRPC authorization service.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "envoy-als.foo.svc.cluster.local" or "bar/envoy-als.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. The friendly name of the access log.
	// Defaults:
	// -  "http_envoy_accesslog"
	// -  "listener_envoy_accesslog"
	LogName string `protobuf:"bytes,3,opt,name=log_name,json=logName,proto3" json:"log_name,omitempty"`
	// Optional. Additional filter state objects to log.
	FilterStateObjectsToLog []string `` /* 136-byte string literal not displayed */
	// Optional. Additional request headers to log.
	AdditionalRequestHeadersToLog []string `` /* 154-byte string literal not displayed */
	// Optional. Additional response headers to log.
	AdditionalResponseHeadersToLog []string `` /* 157-byte string literal not displayed */
	// Optional. Additional response trailers to log.
	AdditionalResponseTrailersToLog []string `` /* 160-byte string literal not displayed */
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyOpenTelemetryLogProvider struct {

	// REQUIRED. Specifies the service that implements the Envoy ALS gRPC authorization service.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "envoy-als.foo.svc.cluster.local" or "bar/envoy-als.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. The friendly name of the access log.
	// Defaults:
	// - "otel_envoy_accesslog"
	LogName string `protobuf:"bytes,3,opt,name=log_name,json=logName,proto3" json:"log_name,omitempty"`
	// Optional. Format for the proxy access log
	// Empty value results in proxy's default access log format, following Envoy access logging formatting.
	LogFormat *MeshConfig_ExtensionProvider_EnvoyOpenTelemetryLogProvider_LogFormat `protobuf:"bytes,4,opt,name=log_format,json=logFormat,proto3" json:"log_format,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyOpenTelemetryLogProvider_LogFormat struct {

	// Textual format for the envoy access logs. Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be
	// used in the format. The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings)
	// provides more information.
	// Alias to `body` filed in [Open Telemetry](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/access_loggers/open_telemetry/v3/logs_service.proto)
	// Example: `text: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%"`
	Text string `protobuf:"bytes,1,opt,name=text,proto3" json:"text,omitempty"`
	// Optional. Additional attributes that describe the specific event occurrence.
	// Structured format for the envoy access logs. Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
	// can be used as values for fields within the Struct. Values are rendered
	// as strings, numbers, or boolean values, as appropriate
	// (see: [format dictionaries](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-dictionaries)). Nested JSON is
	// supported for some command operators (e.g. FILTER_STATE or DYNAMIC_METADATA).
	// Alias to `attributes` filed in [Open Telemetry](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/access_loggers/open_telemetry/v3/logs_service.proto)
	//
	// Example:
	// “`
	// labels:
	//
	//	status: "%RESPONSE_CODE%"
	//	message: "%LOCAL_REPLY_BODY%"
	//
	// “`
	Labels *_struct.Struct `protobuf:"bytes,2,opt,name=labels,proto3" json:"labels,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_EnvoyOtelAls struct {
	// Configures an Envoy Open Telemetry Access Logging Service provider.
	EnvoyOtelAls *MeshConfig_ExtensionProvider_EnvoyOpenTelemetryLogProvider `protobuf:"bytes,14,opt,name=envoy_otel_als,json=envoyOtelAls,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyTcpAls struct {
	// Configures an Envoy Access Logging Service provider for TCP traffic.
	EnvoyTcpAls *MeshConfig_ExtensionProvider_EnvoyTcpGrpcV3LogProvider `protobuf:"bytes,13,opt,name=envoy_tcp_als,json=envoyTcpAls,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_EnvoyTcpGrpcV3LogProvider struct {

	// REQUIRED. Specifies the service that implements the Envoy ALS gRPC authorization service.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "envoy-als.foo.svc.cluster.local" or "bar/envoy-als.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. The friendly name of the access log.
	// Defaults:
	// - "tcp_envoy_accesslog"
	// - "listener_envoy_accesslog"
	LogName string `protobuf:"bytes,3,opt,name=log_name,json=logName,proto3" json:"log_name,omitempty"`
	// Optional. Additional filter state objects to log.
	FilterStateObjectsToLog []string `` /* 136-byte string literal not displayed */
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_Lightstep struct {
	// $hide_from_docs
	// Configures a Lightstep tracing provider.
	// Deprecated: For Istio 1.15+, please use an OpenTelemetryTracingProvider instead, more details can be found at https://github.com/istio/istio/issues/40027
	//
	// Deprecated: Marked as deprecated in mesh/v1alpha1/config.proto.
	Lightstep *MeshConfig_ExtensionProvider_LightstepTracingProvider `protobuf:"bytes,5,opt,name=lightstep,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_LightstepTracingProvider struct {

	// REQUIRED. Specifies the service for the Lightstep collector.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "lightstep.default.svc.cluster.local" or "bar/lightstep.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// The Lightstep access token.
	AccessToken string `protobuf:"bytes,3,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	// Optional. Controls the overall path length allowed in a reported span.
	// NOTE: currently only controls max length of the path tag.
	MaxTagLength uint32 `protobuf:"varint,4,opt,name=max_tag_length,json=maxTagLength,proto3" json:"max_tag_length,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider struct {

	// REQUIRED. Specifies the service for the OpenCensusAgent.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "ocagent.default.svc.cluster.local" or "bar/ocagent.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Specifies the set of context propagation headers used for distributed
	// tracing. Default is `["W3C_TRACE_CONTEXT"]`. If multiple values are specified,
	// the proxy will attempt to read each header for each request and will
	// write all headers.
	Context []MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider_TraceContext `` /* 173-byte string literal not displayed */
	// Optional. Controls the overall path length allowed in a reported span.
	// NOTE: currently only controls max length of the path tag.
	MaxTagLength uint32 `protobuf:"varint,4,opt,name=max_tag_length,json=maxTagLength,proto3" json:"max_tag_length,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider_TraceContext int32

type MeshConfig_ExtensionProvider_OpenTelemetryTracingProvider struct {

	// REQUIRED. Specifies the OpenTelemetry endpoint that will receive OTLP traces.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "otlp.default.svc.cluster.local" or "bar/otlp.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. Controls the overall path length allowed in a reported span.
	// NOTE: currently only controls max length of the path tag.
	MaxTagLength uint32 `protobuf:"varint,3,opt,name=max_tag_length,json=maxTagLength,proto3" json:"max_tag_length,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_Opencensus struct {
	// $hide_from_docs
	// Configures an OpenCensusAgent tracing provider.
	// Deprecated: OpenCensus is deprecated, more details can be found at https://opentelemetry.io/blog/2023/sunsetting-opencensus/
	Opencensus *MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider `protobuf:"bytes,8,opt,name=opencensus,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_Opentelemetry struct {
	// Configures an OpenTelemetry tracing provider.
	Opentelemetry *MeshConfig_ExtensionProvider_OpenTelemetryTracingProvider `protobuf:"bytes,15,opt,name=opentelemetry,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_Prometheus struct {
	// Configures a Prometheus metrics provider.
	Prometheus *MeshConfig_ExtensionProvider_PrometheusMetricsProvider `protobuf:"bytes,10,opt,name=prometheus,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_PrometheusMetricsProvider struct {
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_SkyWalkingTracingProvider struct {

	// REQUIRED. Specifies the service for the SkyWalking receiver.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "skywalking.default.svc.cluster.local" or "bar/skywalking.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. The SkyWalking OAP access token.
	AccessToken string `protobuf:"bytes,3,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_Skywalking struct {
	// Configures a Apache SkyWalking provider.
	Skywalking *MeshConfig_ExtensionProvider_SkyWalkingTracingProvider `protobuf:"bytes,9,opt,name=skywalking,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_Stackdriver struct {
	// Configures a Stackdriver provider.
	Stackdriver *MeshConfig_ExtensionProvider_StackdriverProvider `protobuf:"bytes,7,opt,name=stackdriver,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_StackdriverProvider struct {

	// debug enables trace output to stdout.
	// $hide_from_docs
	//
	// Deprecated: Marked as deprecated in mesh/v1alpha1/config.proto.
	Debug bool `protobuf:"varint,1,opt,name=debug,proto3" json:"debug,omitempty"`
	// The global default max number of attributes per span.
	// default is 200.
	// $hide_from_docs
	//
	// Deprecated: Marked as deprecated in mesh/v1alpha1/config.proto.
	MaxNumberOfAttributes *wrappers.Int64Value `` /* 128-byte string literal not displayed */
	// The global default max number of annotation events per span.
	// default is 200.
	// $hide_from_docs
	//
	// Deprecated: Marked as deprecated in mesh/v1alpha1/config.proto.
	MaxNumberOfAnnotations *wrappers.Int64Value `` /* 131-byte string literal not displayed */
	// The global default max number of message events per span.
	// default is 200.
	// $hide_from_docs
	//
	// Deprecated: Marked as deprecated in mesh/v1alpha1/config.proto.
	MaxNumberOfMessageEvents *wrappers.Int64Value `` /* 139-byte string literal not displayed */
	// Optional. Controls the overall path length allowed in a reported span.
	// NOTE: currently only controls max length of the path tag.
	MaxTagLength uint32 `protobuf:"varint,5,opt,name=max_tag_length,json=maxTagLength,proto3" json:"max_tag_length,omitempty"`
	// Optional. Controls Stackdriver logging behavior.
	Logging *MeshConfig_ExtensionProvider_StackdriverProvider_Logging `protobuf:"bytes,6,opt,name=logging,proto3" json:"logging,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_StackdriverProvider_Logging struct {

	// Collection of tag names and tag expressions to include in the log
	// entry. Conflicts are resolved by the tag name by overriding previously
	// supplied values.
	//
	// Example:
	//
	//	labels:
	//	  path: request.url_path
	//	  foo: request.headers['x-foo']
	Labels map[string]string `` /* 153-byte string literal not displayed */
	// contains filtered or unexported fields
}

type MeshConfig_ExtensionProvider_Zipkin struct {
	// Configures a tracing provider that uses the Zipkin API.
	Zipkin *MeshConfig_ExtensionProvider_ZipkinTracingProvider `protobuf:"bytes,4,opt,name=zipkin,proto3,oneof"`
}

type MeshConfig_ExtensionProvider_ZipkinTracingProvider struct {

	// REQUIRED. Specifies the service that the Zipkin API.
	// The format is `[<Namespace>/]<Hostname>`. The specification of `<Namespace>` is required only when it is insufficient
	// to unambiguously resolve a service in the service registry. The `<Hostname>` is a fully qualified host name of a
	// service defined by the Kubernetes service or ServiceEntry.
	//
	// Example: "zipkin.default.svc.cluster.local" or "bar/zipkin.example.com".
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// REQUIRED. Specifies the port of the service.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional. Controls the overall path length allowed in a reported span.
	// NOTE: currently only controls max length of the path tag.
	MaxTagLength uint32 `protobuf:"varint,3,opt,name=max_tag_length,json=maxTagLength,proto3" json:"max_tag_length,omitempty"`
	// Optional. A 128 bit trace id will be used in Istio.
	// If true, will result in a 64 bit trace id being used.
	Enable_64BitTraceId bool `protobuf:"varint,4,opt,name=enable_64bit_trace_id,json=enable64bitTraceId,proto3" json:"enable_64bit_trace_id,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_H2UpgradePolicy int32

type MeshConfig_IngressControllerMode int32

type MeshConfig_OutboundTrafficPolicy struct {
	Mode MeshConfig_OutboundTrafficPolicy_Mode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode" json:"mode,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_OutboundTrafficPolicy_Mode int32

type MeshConfig_ProxyPathNormalization struct {
	Normalization MeshConfig_ProxyPathNormalization_NormalizationType `` /* 157-byte string literal not displayed */
	// contains filtered or unexported fields
}

type MeshConfig_ProxyPathNormalization_NormalizationType int32

type MeshConfig_ServiceSettings struct {

	// The settings to apply to the selected services.
	Settings *MeshConfig_ServiceSettings_Settings `protobuf:"bytes,1,opt,name=settings,proto3" json:"settings,omitempty"`
	// The services to which the Settings should be applied. Services are selected using the hostname
	// matching rules used by DestinationRule.
	//
	// For example: foo.bar.svc.cluster.local, *.baz.svc.cluster.local
	Hosts []string `protobuf:"bytes,2,rep,name=hosts,proto3" json:"hosts,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_ServiceSettings_Settings struct {

	// If true, specifies that the client and service endpoints must reside in the same cluster.
	// By default, in multi-cluster deployments, the Istio control plane assumes all service
	// endpoints to be reachable from any client in any of the clusters which are part of the
	// mesh. This configuration option limits the set of service endpoints visible to a client
	// to be cluster scoped.
	//
	// There are some common scenarios when this can be useful:
	//
	//   - A service (or group of services) is inherently local to the cluster and has local storage
	//     for that cluster. For example, the kube-system namespace (e.g. the Kube API Server).
	//   - A mesh administrator wants to slowly migrate services to Istio. They might start by first
	//     having services cluster-local and then slowly transition them to mesh-wide. They could do
	//     this service-by-service (e.g. mysvc.myns.svc.cluster.local) or as a group
	//     (e.g. *.myns.svc.cluster.local).
	//
	// By default Istio will consider kubernetes.default.svc (i.e. the API Server) as well as all
	// services in the kube-system namespace to be cluster-local, unless explicitly overridden here.
	ClusterLocal bool `protobuf:"varint,1,opt,name=cluster_local,json=clusterLocal,proto3" json:"cluster_local,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_TLSConfig struct {

	// Optional: the minimum TLS protocol version. The default minimum
	// TLS version will be TLS 1.2. As servers may not be Envoy and be
	// set to TLS 1.2 (e.g., workloads using mTLS without sidecars), the
	// minimum TLS version for clients may also be TLS 1.2.
	// In the current Istio implementation, the maximum TLS protocol version
	// is TLS 1.3.
	MinProtocolVersion MeshConfig_TLSConfig_TLSProtocol `` /* 176-byte string literal not displayed */
	// Optional: If specified, the TLS connection will only support the specified ECDH curves for the DH key exchange.
	// If not specified, the default curves enforced by Envoy will be used. For details about the default curves, refer to
	// [Ecdh Curves](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto).
	EcdhCurves []string `protobuf:"bytes,2,rep,name=ecdh_curves,json=ecdhCurves,proto3" json:"ecdh_curves,omitempty"`
	// Optional: If specified, the TLS connection will only support the specified cipher list when negotiating TLS 1.0-1.2.
	// If not specified, the following cipher suites will be used:
	// “`
	// ECDHE-ECDSA-AES256-GCM-SHA384
	// ECDHE-RSA-AES256-GCM-SHA384
	// ECDHE-ECDSA-AES128-GCM-SHA256
	// ECDHE-RSA-AES128-GCM-SHA256
	// AES256-GCM-SHA384
	// AES128-GCM-SHA256
	// “`
	CipherSuites []string `protobuf:"bytes,3,rep,name=cipher_suites,json=cipherSuites,proto3" json:"cipher_suites,omitempty"`
	// contains filtered or unexported fields
}

type MeshConfig_TLSConfig_TLSProtocol int32

type MeshNetworks struct {

	// The set of networks inside this mesh. Each network should
	// have a unique name and information about how to infer the endpoints in
	// the network as well as the gateways associated with the network.
	Networks map[string]*Network `` /* 157-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Network struct {

	// The list of endpoints in the network (obtained through the
	// constituent service registries or from CIDR ranges). All endpoints in
	// the network are directly accessible to one another.
	Endpoints []*Network_NetworkEndpoints `protobuf:"bytes,2,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	// Set of gateways associated with the network.
	Gateways []*Network_IstioNetworkGateway `protobuf:"bytes,3,rep,name=gateways,proto3" json:"gateways,omitempty"`
	// contains filtered or unexported fields
}

type Network_IstioNetworkGateway struct {

	// Types that are assignable to Gw:
	//
	//	*Network_IstioNetworkGateway_RegistryServiceName
	//	*Network_IstioNetworkGateway_Address
	Gw isNetwork_IstioNetworkGateway_Gw `protobuf_oneof:"gw"`
	// The port associated with the gateway.
	Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	// The locality associated with an explicitly specified gateway (i.e. ip)
	Locality string `protobuf:"bytes,4,opt,name=locality,proto3" json:"locality,omitempty"`
	// contains filtered or unexported fields
}