v1alpha3

type CaptureMode int32

type ClientTLSSettings struct {

	// Indicates whether connections to this port should be secured
	// using TLS. The value of this field determines how TLS is enforced.
	Mode ClientTLSSettings_TLSmode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.networking.v1alpha3.ClientTLSSettings_TLSmode" json:"mode,omitempty"`
	// REQUIRED if mode is `MUTUAL`. The path to the file holding the
	// client-side TLS certificate to use.
	// Should be empty if mode is `ISTIO_MUTUAL`.
	ClientCertificate string `protobuf:"bytes,2,opt,name=client_certificate,json=clientCertificate,proto3" json:"client_certificate,omitempty"`
	// REQUIRED if mode is `MUTUAL`. The path to the file holding the
	// client's private key.
	// Should be empty if mode is `ISTIO_MUTUAL`.
	PrivateKey string `protobuf:"bytes,3,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// OPTIONAL: The path to the file containing certificate authority
	// certificates to use in verifying a presented server certificate. If
	// omitted, the proxy will not verify the server's certificate.
	// Should be empty if mode is `ISTIO_MUTUAL`.
	CaCertificates string `protobuf:"bytes,4,opt,name=ca_certificates,json=caCertificates,proto3" json:"ca_certificates,omitempty"`
	// The name of the secret that holds the TLS certs for the
	// client including the CA certificates. This secret must exist in
	// the namespace of the proxy using the certificates.
	// An Opaque secret should contain the following keys and values:
	// `key: <privateKey>`, `cert: <clientCert>`, `cacert: <CACertificate>`,
	// `crl: <certificateRevocationList>`
	// Here CACertificate is used to verify the server certificate.
	// For mutual TLS, `cacert: <CACertificate>` can be provided in the
	// same secret or a separate secret named `<secret>-cacert`.
	// A TLS secret for client certificates with an additional
	// `ca.crt` key for CA certificates and `ca.crl` key for
	// certificate revocation list(CRL) is also supported.
	// Only one of client certificates and CA certificate
	// or credentialName can be specified.
	//
	// **NOTE:** This field is applicable at sidecars only if
	// `DestinationRule` has a `workloadSelector` specified.
	// Otherwise the field will be applicable only at gateways, and
	// sidecars will continue to use the certificate paths.
	CredentialName string `protobuf:"bytes,7,opt,name=credential_name,json=credentialName,proto3" json:"credential_name,omitempty"`
	// A list of alternate names to verify the subject identity in the
	// certificate. If specified, the proxy will verify that the server
	// certificate's subject alt name matches one of the specified values.
	// If specified, this list overrides the value of subject_alt_names
	// from the ServiceEntry. If unspecified, automatic validation of upstream
	// presented certificate for new upstream connections will be done based on the
	// downstream HTTP host/authority header, provided `VERIFY_CERTIFICATE_AT_CLIENT`
	// and `ENABLE_AUTO_SNI` environmental variables are set to `true`.
	SubjectAltNames []string `protobuf:"bytes,5,rep,name=subject_alt_names,json=subjectAltNames,proto3" json:"subject_alt_names,omitempty"`
	// SNI string to present to the server during TLS handshake.
	// If unspecified, SNI will be automatically set based on downstream HTTP
	// host/authority header for SIMPLE and MUTUAL TLS modes, provided `ENABLE_AUTO_SNI`
	// environmental variable is set to `true`.
	Sni string `protobuf:"bytes,6,opt,name=sni,proto3" json:"sni,omitempty"`
	// `insecureSkipVerify` specifies whether the proxy should skip verifying the
	// CA signature and SAN for the server certificate corresponding to the host.
	// This flag should only be set if global CA signature verification is
	// enabled, `VERIFY_CERTIFICATE_AT_CLIENT` environmental variable is set to `true`,
	// but no verification is desired for a specific host. If enabled with or
	// without `VERIFY_CERTIFICATE_AT_CLIENT` enabled, verification of the CA signature and
	// SAN will be skipped.
	//
	// `insecureSkipVerify` is `false` by default.
	// `VERIFY_CERTIFICATE_AT_CLIENT` is `false` by default in Istio version 1.9 but will
	// be `true` by default in a later version where, going forward, it will be
	// enabled by default.
	InsecureSkipVerify *wrappers.BoolValue `protobuf:"bytes,8,opt,name=insecure_skip_verify,json=insecureSkipVerify,proto3" json:"insecure_skip_verify,omitempty"`
	// contains filtered or unexported fields
}

type ClientTLSSettings_TLSmode int32

type ConnectionPoolSettings struct {

	// Settings common to both HTTP and TCP upstream connections.
	Tcp *ConnectionPoolSettings_TCPSettings `protobuf:"bytes,1,opt,name=tcp,proto3" json:"tcp,omitempty"`
	// HTTP connection pool settings.
	Http *ConnectionPoolSettings_HTTPSettings `protobuf:"bytes,2,opt,name=http,proto3" json:"http,omitempty"`
	// contains filtered or unexported fields
}

type ConnectionPoolSettings_HTTPSettings struct {

	// Maximum number of requests that will be queued while waiting for
	// a ready connection pool connection. Default 2^32-1.
	// Refer to https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/circuit_breaking
	// under which conditions a new connection is created for HTTP2.
	// Please note that this is applicable to both HTTP/1.1 and HTTP2.
	Http1MaxPendingRequests int32 `` /* 135-byte string literal not displayed */
	// Maximum number of active requests to a destination. Default 2^32-1.
	// Please note that this is applicable to both HTTP/1.1 and HTTP2.
	Http2MaxRequests int32 `protobuf:"varint,2,opt,name=http2_max_requests,json=http2MaxRequests,proto3" json:"http2_max_requests,omitempty"`
	// Maximum number of requests per connection to a backend. Setting this
	// parameter to 1 disables keep alive. Default 0, meaning "unlimited",
	// up to 2^29.
	MaxRequestsPerConnection int32 `` /* 138-byte string literal not displayed */
	// Maximum number of retries that can be outstanding to all hosts in a
	// cluster at a given time. Defaults to 2^32-1.
	MaxRetries int32 `protobuf:"varint,4,opt,name=max_retries,json=maxRetries,proto3" json:"max_retries,omitempty"`
	// The idle timeout for upstream connection pool connections. The idle timeout
	// is defined as the period in which there are no active requests.
	// If not set, the default is 1 hour. When the idle timeout is reached,
	// the connection will be closed. If the connection is an HTTP/2
	// connection a drain sequence will occur prior to closing the connection.
	// Note that request based timeouts mean that HTTP/2 PINGs will not
	// keep the connection alive. Applies to both HTTP1.1 and HTTP2 connections.
	IdleTimeout *duration.Duration `protobuf:"bytes,5,opt,name=idle_timeout,json=idleTimeout,proto3" json:"idle_timeout,omitempty"`
	// Specify if http1.1 connection should be upgraded to http2 for the associated destination.
	H2UpgradePolicy ConnectionPoolSettings_HTTPSettings_H2UpgradePolicy `` /* 192-byte string literal not displayed */
	// If set to true, client protocol will be preserved while initiating connection to backend.
	// Note that when this is set to true, h2_upgrade_policy will be ineffective i.e. the client
	// connections will not be upgraded to http2.
	UseClientProtocol bool `protobuf:"varint,7,opt,name=use_client_protocol,json=useClientProtocol,proto3" json:"use_client_protocol,omitempty"`
	// The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
	// Defaults to 2^31-1.
	MaxConcurrentStreams int32 `protobuf:"varint,8,opt,name=max_concurrent_streams,json=maxConcurrentStreams,proto3" json:"max_concurrent_streams,omitempty"`
	// contains filtered or unexported fields
}

type ConnectionPoolSettings_HTTPSettings_H2UpgradePolicy int32

type ConnectionPoolSettings_TCPSettings struct {

	// Maximum number of HTTP1 /TCP connections to a destination host. Default 2^32-1.
	MaxConnections int32 `protobuf:"varint,1,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
	// TCP connection timeout. format:
	// 1h/1m/1s/1ms. MUST BE >=1ms. Default is 10s.
	ConnectTimeout *duration.Duration `protobuf:"bytes,2,opt,name=connect_timeout,json=connectTimeout,proto3" json:"connect_timeout,omitempty"`
	// If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
	TcpKeepalive *ConnectionPoolSettings_TCPSettings_TcpKeepalive `protobuf:"bytes,3,opt,name=tcp_keepalive,json=tcpKeepalive,proto3" json:"tcp_keepalive,omitempty"`
	// The maximum duration of a connection. The duration is defined as the period since a connection
	// was established. If not set, there is no max duration. When max_connection_duration
	// is reached the connection will be closed. Duration must be at least 1ms.
	MaxConnectionDuration *duration.Duration `` /* 126-byte string literal not displayed */
	// The idle timeout for TCP connections.
	// The idle timeout is defined as the period in which there are no bytes sent or received on either
	// the upstream or downstream connection.
	// If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled.
	// Idle timeout is not configured per each cluster individually when weighted destinations are used,
	// because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout
	// specified in a destination rule for the first weighted route is configured in the listener,
	// which means also for all weighted routes.
	IdleTimeout *duration.Duration `protobuf:"bytes,5,opt,name=idle_timeout,json=idleTimeout,proto3" json:"idle_timeout,omitempty"`
	// contains filtered or unexported fields
}

type ConnectionPoolSettings_TCPSettings_TcpKeepalive struct {

	// Maximum number of keepalive probes to send without response before
	// deciding the connection is dead. Default is to use the OS level configuration
	// (unless overridden, Linux defaults to 9.)
	Probes uint32 `protobuf:"varint,1,opt,name=probes,proto3" json:"probes,omitempty"`
	// The time duration a connection needs to be idle before keep-alive
	// probes start being sent. Default is to use the OS level configuration
	// (unless overridden, Linux defaults to 7200s (ie 2 hours.)
	Time *duration.Duration `protobuf:"bytes,2,opt,name=time,proto3" json:"time,omitempty"`
	// The time duration between keep-alive probes.
	// Default is to use the OS level configuration
	// (unless overridden, Linux defaults to 75s.)
	Interval *duration.Duration `protobuf:"bytes,3,opt,name=interval,proto3" json:"interval,omitempty"`
	// contains filtered or unexported fields
}

type CorsPolicy struct {

	// The list of origins that are allowed to perform CORS requests. The
	// content will be serialized into the Access-Control-Allow-Origin
	// header. Wildcard * will allow all origins.
	// $hide_from_docs
	//
	// Deprecated: Marked as deprecated in networking/v1alpha3/virtual_service.proto.
	AllowOrigin []string `protobuf:"bytes,1,rep,name=allow_origin,json=allowOrigin,proto3" json:"allow_origin,omitempty"`
	// String patterns that match allowed origins.
	// An origin is allowed if any of the string matchers match.
	// If a match is found, then the outgoing Access-Control-Allow-Origin would be set to the origin as provided by the client.
	AllowOrigins []*StringMatch `protobuf:"bytes,7,rep,name=allow_origins,json=allowOrigins,proto3" json:"allow_origins,omitempty"`
	// List of HTTP methods allowed to access the resource. The content will
	// be serialized into the Access-Control-Allow-Methods header.
	AllowMethods []string `protobuf:"bytes,2,rep,name=allow_methods,json=allowMethods,proto3" json:"allow_methods,omitempty"`
	// List of HTTP headers that can be used when requesting the
	// resource. Serialized to Access-Control-Allow-Headers header.
	AllowHeaders []string `protobuf:"bytes,3,rep,name=allow_headers,json=allowHeaders,proto3" json:"allow_headers,omitempty"`
	// A list of HTTP headers that the browsers are allowed to
	// access. Serialized into Access-Control-Expose-Headers header.
	ExposeHeaders []string `protobuf:"bytes,4,rep,name=expose_headers,json=exposeHeaders,proto3" json:"expose_headers,omitempty"`
	// Specifies how long the results of a preflight request can be
	// cached. Translates to the `Access-Control-Max-Age` header.
	MaxAge *duration.Duration `protobuf:"bytes,5,opt,name=max_age,json=maxAge,proto3" json:"max_age,omitempty"`
	// Indicates whether the caller is allowed to send the actual request
	// (not the preflight) using credentials. Translates to
	// `Access-Control-Allow-Credentials` header.
	AllowCredentials *wrappers.BoolValue `protobuf:"bytes,6,opt,name=allow_credentials,json=allowCredentials,proto3" json:"allow_credentials,omitempty"`
	// contains filtered or unexported fields
}

type Delegate struct {

	// Name specifies the name of the delegate VirtualService.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Namespace specifies the namespace where the delegate VirtualService resides.
	// By default, it is same to the root's.
	Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// contains filtered or unexported fields
}

type Destination struct {

	// The name of a service from the service registry. Service
	// names are looked up from the platform's service registry (e.g.,
	// Kubernetes services, Consul services, etc.) and from the hosts
	// declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to
	// destinations that are not found in either of the two, will be dropped.
	//
	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
	// the short name based on the namespace of the rule, not the service. A
	// rule in the "default" namespace containing a host "reviews will be
	// interpreted as "reviews.default.svc.cluster.local", irrespective of
	// the actual namespace associated with the reviews service. To avoid
	// potential misconfiguration, it is recommended to always use fully
	// qualified domain names over short names.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// The name of a subset within the service. Applicable only to services
	// within the mesh. The subset must be defined in a corresponding
	// DestinationRule.
	Subset string `protobuf:"bytes,2,opt,name=subset,proto3" json:"subset,omitempty"`
	// Specifies the port on the host that is being addressed. If a service
	// exposes only a single port it is not required to explicitly select the
	// port.
	Port *PortSelector `protobuf:"bytes,3,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type DestinationRule struct {

	// The name of a service from the service registry. Service
	// names are looked up from the platform's service registry (e.g.,
	// Kubernetes services, Consul services, etc.) and from the hosts
	// declared by [ServiceEntries](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Rules defined for
	// services that do not exist in the service registry will be ignored.
	//
	// *Note for Kubernetes users*: When short names are used (e.g. "reviews"
	// instead of "reviews.default.svc.cluster.local"), Istio will interpret
	// the short name based on the namespace of the rule, not the service. A
	// rule in the "default" namespace containing a host "reviews" will be
	// interpreted as "reviews.default.svc.cluster.local", irrespective of
	// the actual namespace associated with the reviews service. _To avoid
	// potential misconfigurations, it is recommended to always use fully
	// qualified domain names over short names._
	//
	// Note that the host field applies to both HTTP and TCP services.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// Traffic policies to apply (load balancing policy, connection pool
	// sizes, outlier detection).
	TrafficPolicy *TrafficPolicy `protobuf:"bytes,2,opt,name=traffic_policy,json=trafficPolicy,proto3" json:"traffic_policy,omitempty"`
	// One or more named sets that represent individual versions of a
	// service. Traffic policies can be overridden at subset level.
	Subsets []*Subset `protobuf:"bytes,3,rep,name=subsets,proto3" json:"subsets,omitempty"`
	// A list of namespaces to which this destination rule is exported.
	// The resolution of a destination rule to apply to a service occurs in the
	// context of a hierarchy of namespaces. Exporting a destination rule allows
	// it to be included in the resolution hierarchy for services in
	// other namespaces. This feature provides a mechanism for service owners
	// and mesh administrators to control the visibility of destination rules
	// across namespace boundaries.
	//
	// If no namespaces are specified then the destination rule is exported to all
	// namespaces by default.
	//
	// The value "." is reserved and defines an export to the same namespace that
	// the destination rule is declared in. Similarly, the value "*" is reserved and
	// defines an export to all namespaces.
	ExportTo []string `protobuf:"bytes,4,rep,name=export_to,json=exportTo,proto3" json:"export_to,omitempty"`
	// Criteria used to select the specific set of pods/VMs on which this
	// `DestinationRule` configuration should be applied. If specified, the `DestinationRule`
	// configuration will be applied only to the workload instances matching the workload selector
	// label in the same namespace. Workload selectors do not apply across namespace boundaries.
	// If omitted, the `DestinationRule` falls back to its default behavior.
	// For example, if specific sidecars need to have egress TLS settings for services outside
	// of the mesh, instead of every sidecar in the mesh needing to have the
	// configuration (which is the default behaviour), a workload selector can be specified.
	WorkloadSelector *v1beta1.WorkloadSelector `protobuf:"bytes,5,opt,name=workload_selector,json=workloadSelector,proto3" json:"workload_selector,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter struct {

	// Criteria used to select the specific set of pods/VMs on which
	// this patch configuration should be applied. If omitted, the set
	// of patches in this configuration will be applied to all workload
	// instances in the same namespace. If the `EnvoyFilter` is present
	// in the config root namespace, it will be applied to all applicable
	// workloads in any namespace.
	WorkloadSelector *WorkloadSelector `protobuf:"bytes,3,opt,name=workload_selector,json=workloadSelector,proto3" json:"workload_selector,omitempty"`
	// One or more patches with match conditions.
	ConfigPatches []*EnvoyFilter_EnvoyConfigObjectPatch `protobuf:"bytes,4,rep,name=config_patches,json=configPatches,proto3" json:"config_patches,omitempty"`
	// Priority defines the order in which patch sets are applied within a context.
	// When one patch depends on another patch, the order of patch application
	// is significant. The API provides two primary ways to order patches.
	// Patch sets in the root namespace are applied before the patch sets in the
	// workload namespace. Patches within a patch set are processed in the order
	// that they appear in the `configPatches` list.
	//
	// The default value for priority is 0 and the range is [ min-int32, max-int32 ].
	// A patch set with a negative priority is processed before the default. A patch
	// set with a positive priority is processed after the default.
	//
	// It is recommended to start with priority values that are multiples of 10
	// to leave room for further insertion.
	//
	// Patch sets are sorted in the following ascending key order:
	// priority, creation time, fully qualified resource name.
	Priority int32 `protobuf:"varint,5,opt,name=priority,proto3" json:"priority,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_ApplyTo int32

type EnvoyFilter_ClusterMatch struct {

	// The service port for which this cluster was generated.  If
	// omitted, applies to clusters for any port.
	// **Note:** for inbound cluster, it is the service target port.
	PortNumber uint32 `protobuf:"varint,1,opt,name=port_number,json=portNumber,proto3" json:"port_number,omitempty"`
	// The fully qualified service name for this cluster. If omitted,
	// applies to clusters for any service. For services defined
	// through service entries, the service name is same as the hosts
	// defined in the service entry.
	// **Note:** for inbound cluster, this is ignored.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// The subset associated with the service. If omitted, applies to
	// clusters for any subset of a service.
	Subset string `protobuf:"bytes,3,opt,name=subset,proto3" json:"subset,omitempty"`
	// The exact name of the cluster to match. To match a specific
	// cluster by name, such as the internally generated `Passthrough`
	// cluster, leave all fields in clusterMatch empty, except the
	// name.
	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_EnvoyConfigObjectMatch struct {

	// The specific config generation context to match on. Istio Pilot
	// generates envoy configuration in the context of a gateway,
	// inbound traffic to sidecar and outbound traffic from sidecar.
	Context EnvoyFilter_PatchContext `protobuf:"varint,1,opt,name=context,proto3,enum=istio.networking.v1alpha3.EnvoyFilter_PatchContext" json:"context,omitempty"`
	// Match on properties associated with a proxy.
	Proxy *EnvoyFilter_ProxyMatch `protobuf:"bytes,2,opt,name=proxy,proto3" json:"proxy,omitempty"`
	// Types that are assignable to ObjectTypes:
	//
	//	*EnvoyFilter_EnvoyConfigObjectMatch_Listener
	//	*EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration
	//	*EnvoyFilter_EnvoyConfigObjectMatch_Cluster
	ObjectTypes isEnvoyFilter_EnvoyConfigObjectMatch_ObjectTypes `protobuf_oneof:"object_types"`
	// contains filtered or unexported fields
}

type EnvoyFilter_EnvoyConfigObjectMatch_Cluster struct {
	// Match on envoy cluster attributes.
	Cluster *EnvoyFilter_ClusterMatch `protobuf:"bytes,5,opt,name=cluster,proto3,oneof"`
}

type EnvoyFilter_EnvoyConfigObjectMatch_Listener struct {
	// Match on envoy listener attributes.
	Listener *EnvoyFilter_ListenerMatch `protobuf:"bytes,3,opt,name=listener,proto3,oneof"`
}

type EnvoyFilter_EnvoyConfigObjectMatch_RouteConfiguration struct {
	// Match on envoy HTTP route configuration attributes.
	RouteConfiguration *EnvoyFilter_RouteConfigurationMatch `protobuf:"bytes,4,opt,name=route_configuration,json=routeConfiguration,proto3,oneof"`
}

type EnvoyFilter_EnvoyConfigObjectPatch struct {

	// Specifies where in the Envoy configuration, the patch should be
	// applied.  The match is expected to select the appropriate
	// object based on applyTo.  For example, an applyTo with
	// `HTTP_FILTER` is expected to have a match condition on the
	// listeners, with a network filter selection on
	// `envoy.filters.network.http_connection_manager` and a sub filter selection on the
	// HTTP filter relative to which the insertion should be
	// performed. Similarly, an applyTo on `CLUSTER` should have a match
	// (if provided) on the cluster and not on a listener.
	ApplyTo EnvoyFilter_ApplyTo `` /* 134-byte string literal not displayed */
	// Match on listener/route configuration/cluster.
	Match *EnvoyFilter_EnvoyConfigObjectMatch `protobuf:"bytes,2,opt,name=match,proto3" json:"match,omitempty"`
	// The patch to apply along with the operation.
	Patch *EnvoyFilter_Patch `protobuf:"bytes,3,opt,name=patch,proto3" json:"patch,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_ListenerMatch struct {

	// The service port/gateway port to which traffic is being
	// sent/received. If not specified, matches all listeners. Even though
	// inbound listeners are generated for the instance/pod ports, only
	// service ports should be used to match listeners.
	PortNumber uint32 `protobuf:"varint,1,opt,name=port_number,json=portNumber,proto3" json:"port_number,omitempty"`
	// Instead of using specific port numbers, a set of ports matching
	// a given service's port name can be selected. Matching is case
	// insensitive.
	// Not implemented.
	// $hide_from_docs
	PortName string `protobuf:"bytes,2,opt,name=port_name,json=portName,proto3" json:"port_name,omitempty"`
	// Match a specific filter chain in a listener. If specified, the
	// patch will be applied to the filter chain (and a specific
	// filter if specified) and not to other filter chains in the
	// listener.
	FilterChain *EnvoyFilter_ListenerMatch_FilterChainMatch `protobuf:"bytes,3,opt,name=filter_chain,json=filterChain,proto3" json:"filter_chain,omitempty"`
	// Match a specific listener filter. If specified, the
	// patch will be applied to the listener filter.
	ListenerFilter string `protobuf:"bytes,5,opt,name=listener_filter,json=listenerFilter,proto3" json:"listener_filter,omitempty"`
	// Match a specific listener by its name. The listeners generated
	// by Pilot are typically named as IP:Port.
	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_ListenerMatch_FilterChainMatch struct {

	// The name assigned to the filter chain.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The SNI value used by a filter chain's match condition.  This
	// condition will evaluate to false if the filter chain has no
	// sni match.
	Sni string `protobuf:"bytes,2,opt,name=sni,proto3" json:"sni,omitempty"`
	// Applies only to `SIDECAR_INBOUND` context. If non-empty, a
	// transport protocol to consider when determining a filter
	// chain match.  This value will be compared against the
	// transport protocol of a new connection, when it's detected by
	// the `tls_inspector` listener filter.
	//
	// Accepted values include:
	//
	// * `raw_buffer` - default, used when no transport protocol is detected.
	// * `tls` - set when TLS protocol is detected by the TLS inspector.
	TransportProtocol string `protobuf:"bytes,3,opt,name=transport_protocol,json=transportProtocol,proto3" json:"transport_protocol,omitempty"`
	// Applies only to sidecars. If non-empty, a comma separated set
	// of application protocols to consider when determining a
	// filter chain match.  This value will be compared against the
	// application protocols of a new connection, when it's detected
	// by one of the listener filters such as the `http_inspector`.
	//
	// Accepted values include: h2, http/1.1, http/1.0
	ApplicationProtocols string `protobuf:"bytes,4,opt,name=application_protocols,json=applicationProtocols,proto3" json:"application_protocols,omitempty"`
	// The name of a specific filter to apply the patch to. Set this
	// to `envoy.filters.network.http_connection_manager` to add a filter or apply a
	// patch to the HTTP connection manager.
	Filter *EnvoyFilter_ListenerMatch_FilterMatch `protobuf:"bytes,5,opt,name=filter,proto3" json:"filter,omitempty"`
	// The destination_port value used by a filter chain's match condition.
	// This condition will evaluate to false if the filter chain has no destination_port match.
	DestinationPort uint32 `protobuf:"varint,6,opt,name=destination_port,json=destinationPort,proto3" json:"destination_port,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_ListenerMatch_FilterMatch struct {

	// The filter name to match on.
	// For standard Envoy filters, [canonical filter](https://www.envoyproxy.io/docs/envoy/latest/version_history/v1.14.0#deprecated)
	// names should be used.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The next level filter within this filter to match
	// upon. Typically used for HTTP Connection Manager filters and
	// Thrift filters.
	SubFilter *EnvoyFilter_ListenerMatch_SubFilterMatch `protobuf:"bytes,2,opt,name=sub_filter,json=subFilter,proto3" json:"sub_filter,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_ListenerMatch_SubFilterMatch struct {

	// The filter name to match on.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type EnvoyFilter_Patch struct {

	// Determines how the patch should be applied.
	Operation EnvoyFilter_Patch_Operation `` /* 131-byte string literal not displayed */
	// The JSON config of the object being patched. This will be merged using
	// proto merge semantics with the existing proto in the path.
	Value *_struct.Struct `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// Determines the filter insertion order.
	FilterClass EnvoyFilter_Patch_FilterClass `` /* 156-byte string literal not displayed */
	// contains filtered or unexported fields
}

type EnvoyFilter_PatchContext int32

type EnvoyFilter_Patch_FilterClass int32

type EnvoyFilter_Patch_Operation int32

type EnvoyFilter_ProxyMatch struct {

	// A regular expression in golang regex format (RE2) that can be
	// used to select proxies using a specific version of istio
	// proxy. The Istio version for a given proxy is obtained from the
	// node metadata field `ISTIO_VERSION` supplied by the proxy when
	// connecting to Pilot. This value is embedded as an environment
	// variable (`ISTIO_META_ISTIO_VERSION`) in the Istio proxy docker
	// image. Custom proxy implementations should provide this metadata
	// variable to take advantage of the Istio version check option.
	ProxyVersion string `protobuf:"bytes,1,opt,name=proxy_version,json=proxyVersion,proto3" json:"proxy_version,omitempty"`
	// Match on the node metadata supplied by a proxy when connecting
	// to Istio Pilot. Note that while Envoy's node metadata is of
	// type Struct, only string key-value pairs are processed by
	// Pilot. All keys specified in the metadata must match with exact
	// values. The match will fail if any of the specified keys are
	// absent or the values fail to match.
	Metadata map[string]string `` /* 157-byte string literal not displayed */
	// contains filtered or unexported fields
}

type EnvoyFilter_RouteConfigurationMatch struct {

	// The service port number or gateway server port number for which
	// this route configuration was generated. If omitted, applies to
	// route configurations for all ports.
	PortNumber uint32 `protobuf:"varint,1,opt,name=port_number,json=portNumber,proto3" json:"port_number,omitempty"`
	// Applicable only for GATEWAY context. The gateway server port
	// name for which this route configuration was generated.
	PortName string `protobuf:"bytes,2,opt,name=port_name,json=portName,proto3" json:"port_name,omitempty"`
	// The Istio gateway config's namespace/name for which this route
	// configuration was generated. Applies only if the context is
	// GATEWAY. Should be in the namespace/name format. Use this field
	// in conjunction with the `portNumber` and `portName` to accurately
	// select the Envoy route configuration for a specific HTTPS
	// server within a gateway config object.
	Gateway string `protobuf:"bytes,3,opt,name=gateway,proto3" json:"gateway,omitempty"`
	// Match a specific virtual host in a route configuration and
	// apply the patch to the virtual host.
	Vhost *EnvoyFilter_RouteConfigurationMatch_VirtualHostMatch `protobuf:"bytes,4,opt,name=vhost,proto3" json:"vhost,omitempty"`
	// Route configuration name to match on. Can be used to match a
	// specific route configuration by name, such as the internally
	// generated `http_proxy` route configuration for all sidecars.
	Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}