v1beta1

type AuthorizationPolicy struct {

	// Optional. The selector decides where to apply the authorization policy. The selector will match with workloads
	// in the same namespace as the authorization policy. If the authorization policy is in the root namespace, the selector
	// will additionally match with workloads in all namespaces.
	//
	// If the selector and the targetRef are not set, the selector will match all workloads. At most one of the selector
	// and targetRef can be set.
	Selector *v1beta1.WorkloadSelector `protobuf:"bytes,1,opt,name=selector,proto3" json:"selector,omitempty"`
	// Optional. The targetRef specifies the gateway the policy should be
	// applied to. The targeted resource specified will determine which
	// workloads the authorization policy applies to. The targeted resource
	// must be a `Gateway` in the group `gateway.networking.k8s.io`. The
	// gateway must be in the same namespace as the authorization policy.
	//
	// If not set, the policy is applied as defined by the selector.
	// At most one of the selector and targetRef can be set.
	//
	// NOTE: If you are using the `targetRef` field in a multi-revision environment with Istio versions prior to 1.20,
	// it is highly recommended that you pin the authorization policy to a revision running 1.20+ via the istio.io/rev label.
	// This is to prevent proxies connected to older istiod control planes (that don't know about the targetRef field)
	// from misinterpreting the policy as namespace-wide during the upgrade process.
	TargetRef *v1beta1.PolicyTargetReference `protobuf:"bytes,5,opt,name=targetRef,proto3" json:"targetRef,omitempty"`
	// Optional. A list of rules to match the request. A match occurs when at least one rule matches the request.
	//
	// If not set, the match will never occur. This is equivalent to setting a default of deny for the target workloads if
	// the action is ALLOW.
	Rules []*Rule `protobuf:"bytes,2,rep,name=rules,proto3" json:"rules,omitempty"`
	// Optional. The action to take if the request is matched with the rules. Default is ALLOW if not specified.
	Action AuthorizationPolicy_Action `protobuf:"varint,3,opt,name=action,proto3,enum=istio.security.v1beta1.AuthorizationPolicy_Action" json:"action,omitempty"`
	// Types that are assignable to ActionDetail:
	//
	//	*AuthorizationPolicy_Provider
	ActionDetail isAuthorizationPolicy_ActionDetail `protobuf_oneof:"action_detail"`
	// contains filtered or unexported fields
}

type AuthorizationPolicy_Action int32

type AuthorizationPolicy_ExtensionProvider struct {

	// Specifies the name of the extension provider. The list of available providers is defined in the MeshConfig.
	// Note, currently at most 1 extension provider is allowed per workload. Different workloads can use different extension provider.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type AuthorizationPolicy_Provider struct {
	// Specifies detailed configuration of the CUSTOM action. Must be used only with CUSTOM action.
	Provider *AuthorizationPolicy_ExtensionProvider `protobuf:"bytes,4,opt,name=provider,proto3,oneof"`
}

type ClaimToHeader struct {

	// The name of the header to be created. The header will be overridden if it already exists in the request.
	Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
	// The name of the claim to be copied from. Only claim of type string/int/bool is supported.
	// The header will not be there if the claim does not exist or the type of the claim is not supported.
	Claim string `protobuf:"bytes,2,opt,name=claim,proto3" json:"claim,omitempty"`
	// contains filtered or unexported fields
}

type Condition struct {

	// The name of an Istio attribute.
	// See the [full list of supported attributes](https://istio.io/docs/reference/config/security/conditions/).
	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	// Optional. A list of allowed values for the attribute.
	// Note: at least one of `values` or `notValues` must be set.
	Values []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"`
	// Optional. A list of negative match of values for the attribute.
	// Note: at least one of `values` or `notValues` must be set.
	NotValues []string `protobuf:"bytes,3,rep,name=not_values,json=notValues,proto3" json:"not_values,omitempty"`
	// contains filtered or unexported fields
}

type JWTHeader struct {

	// The HTTP header name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The prefix that should be stripped before decoding the token.
	// For example, for `Authorization: Bearer <token>`, prefix=`Bearer` with a space at the end.
	// If the header doesn't have this exact prefix, it is considered invalid.
	Prefix string `protobuf:"bytes,2,opt,name=prefix,proto3" json:"prefix,omitempty"`
	// contains filtered or unexported fields
}

type JWTRule struct {

	// Identifies the issuer that issued the JWT. See
	// [issuer](https://tools.ietf.org/html/rfc7519#section-4.1.1)
	// A JWT with different `iss` claim will be rejected.
	//
	// Example: `https://foobar.auth0.com`
	// Example: `1234567-compute@developer.gserviceaccount.com`
	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// The list of JWT
	// [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3)
	// that are allowed to access. A JWT containing any of these
	// audiences will be accepted.
	//
	// The service name will be accepted if audiences is empty.
	//
	// Example:
	//
	// “`yaml
	// audiences:
	//   - bookstore_android.apps.example.com
	//     bookstore_web.apps.example.com
	//
	// “`
	Audiences []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"`
	// URL of the provider's public key set to validate signature of the
	// JWT. See [OpenID Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
	//
	// Optional if the key set document can either (a) be retrieved from
	// [OpenID
	// Discovery](https://openid.net/specs/openid-connect-discovery-1_0.html) of
	// the issuer or (b) inferred from the email domain of the issuer (e.g. a
	// Google service account).
	//
	// Example: `https://www.googleapis.com/oauth2/v1/certs`
	//
	// Note: Only one of `jwksUri` and `jwks` should be used.
	// +kubebuilder:altName=jwks_uri
	JwksUri string `protobuf:"bytes,3,opt,name=jwks_uri,json=jwksUri,proto3" json:"jwks_uri,omitempty"`
	// JSON Web Key Set of public keys to validate signature of the JWT.
	// See https://auth0.com/docs/jwks.
	//
	// Note: Only one of `jwksUri` and `jwks` should be used.
	Jwks string `protobuf:"bytes,10,opt,name=jwks,proto3" json:"jwks,omitempty"`
	// List of header locations from which JWT is expected. For example, below is the location spec
	// if JWT is expected to be found in `x-jwt-assertion` header, and have `Bearer` prefix:
	//
	// “`yaml
	//
	//	fromHeaders:
	//	- name: x-jwt-assertion
	//	  prefix: "Bearer "
	//
	// “`
	//
	// Note: Requests with multiple tokens (at different locations) are not supported, the output principal of
	// such requests is undefined.
	FromHeaders []*JWTHeader `protobuf:"bytes,6,rep,name=from_headers,json=fromHeaders,proto3" json:"from_headers,omitempty"`
	// List of query parameters from which JWT is expected. For example, if JWT is provided via query
	// parameter `my_token` (e.g `/path?my_token=<JWT>`), the config is:
	//
	// “`yaml
	//
	//	fromParams:
	//	- "my_token"
	//
	// “`
	//
	// Note: Requests with multiple tokens (at different locations) are not supported, the output principal of
	// such requests is undefined.
	FromParams []string `protobuf:"bytes,7,rep,name=from_params,json=fromParams,proto3" json:"from_params,omitempty"`
	// This field specifies the header name to output a successfully verified JWT payload to the
	// backend. The forwarded data is `base64_encoded(jwt_payload_in_JSON)`. If it is not specified,
	// the payload will not be emitted.
	OutputPayloadToHeader string `` /* 128-byte string literal not displayed */
	// List of cookie names from which JWT is expected.	//
	// For example, if config is:
	//
	// “` yaml
	//
	//	from_cookies:
	//	- auth-token
	//
	// “`
	// Then JWT will be extracted from “auth-token“ cookie in the request.
	//
	// Note: Requests with multiple tokens (at different locations) are not supported, the output principal of
	// such requests is undefined.
	FromCookies []string `protobuf:"bytes,12,rep,name=from_cookies,json=fromCookies,proto3" json:"from_cookies,omitempty"`
	// If set to true, the original token will be kept for the upstream request. Default is false.
	ForwardOriginalToken bool `protobuf:"varint,9,opt,name=forward_original_token,json=forwardOriginalToken,proto3" json:"forward_original_token,omitempty"`
	// This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.
	// This differs from the `output_payload_to_header` by allowing outputting individual claims instead of the whole payload.
	// The header specified in each operation in the list must be unique. Nested claims of type string/int/bool is supported as well.
	// “`
	//
	//	outputClaimToHeaders:
	//	- header: x-my-company-jwt-group
	//	  claim: my-group
	//	- header: x-test-environment-flag
	//	  claim: test-flag
	//	- header: x-jwt-claim-group
	//	  claim: nested.key.group
	//
	// “`
	// [Experimental] This feature is a experimental feature.
	OutputClaimToHeaders []*ClaimToHeader `` // [TODO:Update the status whenever this feature is promoted.]
	/* 126-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Operation struct {

	// Optional. A list of hosts as specified in the HTTP request. The match is case-insensitive.
	// See the [security best practices](https://istio.io/latest/docs/ops/best-practices/security/#writing-host-match-policies) for
	// recommended usage of this field.
	//
	// If not set, any host is allowed. Must be used only with HTTP.
	Hosts []string `protobuf:"bytes,1,rep,name=hosts,proto3" json:"hosts,omitempty"`
	// Optional. A list of negative match of hosts as specified in the HTTP request. The match is case-insensitive.
	NotHosts []string `protobuf:"bytes,5,rep,name=not_hosts,json=notHosts,proto3" json:"not_hosts,omitempty"`
	// Optional. A list of ports as specified in the connection.
	//
	// If not set, any port is allowed.
	Ports []string `protobuf:"bytes,2,rep,name=ports,proto3" json:"ports,omitempty"`
	// Optional. A list of negative match of ports as specified in the connection.
	NotPorts []string `protobuf:"bytes,6,rep,name=not_ports,json=notPorts,proto3" json:"not_ports,omitempty"`
	// Optional. A list of methods as specified in the HTTP request.
	// For gRPC service, this will always be `POST`.
	//
	// If not set, any method is allowed. Must be used only with HTTP.
	Methods []string `protobuf:"bytes,3,rep,name=methods,proto3" json:"methods,omitempty"`
	// Optional. A list of negative match of methods as specified in the HTTP request.
	NotMethods []string `protobuf:"bytes,7,rep,name=not_methods,json=notMethods,proto3" json:"not_methods,omitempty"`
	// Optional. A list of paths as specified in the HTTP request. See the [Authorization Policy Normalization](https://istio.io/latest/docs/reference/config/security/normalization/)
	// for details of the path normalization.
	// For gRPC service, this will be the fully-qualified name in the form of `/package.service/method`.
	//
	// If not set, any path is allowed. Must be used only with HTTP.
	Paths []string `protobuf:"bytes,4,rep,name=paths,proto3" json:"paths,omitempty"`
	// Optional. A list of negative match of paths.
	NotPaths []string `protobuf:"bytes,8,rep,name=not_paths,json=notPaths,proto3" json:"not_paths,omitempty"`
	// contains filtered or unexported fields
}

type PeerAuthentication struct {

	// The selector determines the workloads to apply the PeerAuthentication on. The selector will match with workloads in the
	// same namespace as the policy. If the policy is in the root namespace, the selector will additionally match with workloads in all namespace.
	//
	// If not set, the policy will be applied to all workloads in the same namespace as the policy. If it is in the root namespace, it would be applied
	// to all workloads in the mesh.
	Selector *v1beta1.WorkloadSelector `protobuf:"bytes,1,opt,name=selector,proto3" json:"selector,omitempty"`
	// Mutual TLS settings for workload. If not defined, inherit from parent.
	Mtls *PeerAuthentication_MutualTLS `protobuf:"bytes,2,opt,name=mtls,proto3" json:"mtls,omitempty"`
	// Port specific mutual TLS settings. These only apply when a workload selector
	// is specified.
	PortLevelMtls map[uint32]*PeerAuthentication_MutualTLS `` /* 191-byte string literal not displayed */
	// contains filtered or unexported fields
}

type PeerAuthentication_MutualTLS struct {

	// Defines the mTLS mode used for peer authentication.
	Mode PeerAuthentication_MutualTLS_Mode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.security.v1beta1.PeerAuthentication_MutualTLS_Mode" json:"mode,omitempty"`
	// contains filtered or unexported fields
}

type PeerAuthentication_MutualTLS_Mode int32

type RequestAuthentication struct {

	// Optional. The selector decides where to apply the request authentication policy. The selector will match with workloads
	// in the same namespace as the request authentication policy. If the request authentication policy is in the root namespace,
	// the selector will additionally match with workloads in all namespaces.
	//
	// If not set, the selector will match all workloads. At most one of the selector and targetRef can be set.
	Selector *v1beta1.WorkloadSelector `protobuf:"bytes,1,opt,name=selector,proto3" json:"selector,omitempty"`
	// Optional. The targetRef specifies the gateway the policy should be
	// applied to. The targeted resource specified will determine which
	// workloads the request authentication policy to. The targeted resource
	// must be a `Gateway` in the group `gateway.networking.k8s.io`. The
	// gateway must be in the same namespace as the request authentication
	// policy.
	//
	// If not set, the policy is applied as defined by the selector.
	// At most one of the selector and targetRef can be set.
	// Waypoint proxies will not respect selectors even if they match.
	TargetRef *v1beta1.PolicyTargetReference `protobuf:"bytes,3,opt,name=targetRef,proto3" json:"targetRef,omitempty"`
	// Define the list of JWTs that can be validated at the selected workloads' proxy. A valid token
	// will be used to extract the authenticated identity.
	// Each rule will be activated only when a token is presented at the location recognized by the
	// rule. The token will be validated based on the JWT rule config. If validation fails, the request will
	// be rejected.
	// Note: Requests with multiple tokens (at different locations) are not supported, the output principal of
	// such requests is undefined.
	JwtRules []*JWTRule `protobuf:"bytes,2,rep,name=jwt_rules,json=jwtRules,proto3" json:"jwt_rules,omitempty"`
	// contains filtered or unexported fields
}

type Rule struct {

	// Optional. `from` specifies the source of a request.
	//
	// If not set, any source is allowed.
	From []*Rule_From `protobuf:"bytes,1,rep,name=from,proto3" json:"from,omitempty"`
	// Optional. `to` specifies the operation of a request.
	//
	// If not set, any operation is allowed.
	To []*Rule_To `protobuf:"bytes,2,rep,name=to,proto3" json:"to,omitempty"`
	// Optional. `when` specifies a list of additional conditions of a request.
	//
	// If not set, any condition is allowed.
	When []*Condition `protobuf:"bytes,3,rep,name=when,proto3" json:"when,omitempty"`
	// contains filtered or unexported fields
}

type Rule_From struct {

	// Source specifies the source of a request.
	Source *Source `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
	// contains filtered or unexported fields
}

type Rule_To struct {

	// Operation specifies the operation of a request.
	Operation *Operation `protobuf:"bytes,1,opt,name=operation,proto3" json:"operation,omitempty"`
	// contains filtered or unexported fields
}

type Source struct {

	// Optional. A list of peer identities derived from the peer certificate. The peer identity is in the format of
	// `"<TRUST_DOMAIN>/ns/<NAMESPACE>/sa/<SERVICE_ACCOUNT>"`, for example, `"cluster.local/ns/default/sa/productpage"`.
	// This field requires mTLS enabled and is the same as the `source.principal` attribute.
	//
	// If not set, any principal is allowed.
	Principals []string `protobuf:"bytes,1,rep,name=principals,proto3" json:"principals,omitempty"`
	// Optional. A list of negative match of peer identities.
	NotPrincipals []string `protobuf:"bytes,5,rep,name=not_principals,json=notPrincipals,proto3" json:"not_principals,omitempty"`
	// Optional. A list of request identities derived from the JWT. The request identity is in the format of
	// `"<ISS>/<SUB>"`, for example, `"example.com/sub-1"`. This field requires request authentication enabled and is the
	// same as the `request.auth.principal` attribute.
	//
	// If not set, any request principal is allowed.
	RequestPrincipals []string `protobuf:"bytes,2,rep,name=request_principals,json=requestPrincipals,proto3" json:"request_principals,omitempty"`
	// Optional. A list of negative match of request identities.
	NotRequestPrincipals []string `protobuf:"bytes,6,rep,name=not_request_principals,json=notRequestPrincipals,proto3" json:"not_request_principals,omitempty"`
	// Optional. A list of namespaces derived from the peer certificate.
	// This field requires mTLS enabled and is the same as the `source.namespace` attribute.
	//
	// If not set, any namespace is allowed.
	Namespaces []string `protobuf:"bytes,3,rep,name=namespaces,proto3" json:"namespaces,omitempty"`
	// Optional. A list of negative match of namespaces.
	NotNamespaces []string `protobuf:"bytes,7,rep,name=not_namespaces,json=notNamespaces,proto3" json:"not_namespaces,omitempty"`
	// Optional. A list of IP blocks, populated from the source address of the IP packet. Single IP (e.g. `203.0.113.4`) and
	// CIDR (e.g. `203.0.113.0/24`) are supported. This is the same as the `source.ip` attribute.
	//
	// If not set, any IP is allowed.
	IpBlocks []string `protobuf:"bytes,4,rep,name=ip_blocks,json=ipBlocks,proto3" json:"ip_blocks,omitempty"`
	// Optional. A list of negative match of IP blocks.
	NotIpBlocks []string `protobuf:"bytes,8,rep,name=not_ip_blocks,json=notIpBlocks,proto3" json:"not_ip_blocks,omitempty"`
	// Optional. A list of IP blocks, populated from `X-Forwarded-For` header or proxy protocol.
	// To make use of this field, you must configure the `numTrustedProxies` field of the `gatewayTopology` under the `meshConfig`
	// when you install Istio or using an annotation on the ingress gateway.  See the documentation here:
	// [Configuring Gateway Network Topology](https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/).
	// Single IP (e.g. `203.0.113.4`) and CIDR (e.g. `203.0.113.0/24`) are supported.
	// This is the same as the `remote.ip` attribute.
	//
	// If not set, any IP is allowed.
	RemoteIpBlocks []string `protobuf:"bytes,9,rep,name=remote_ip_blocks,json=remoteIpBlocks,proto3" json:"remote_ip_blocks,omitempty"`
	// Optional. A list of negative match of remote IP blocks.
	NotRemoteIpBlocks []string `protobuf:"bytes,10,rep,name=not_remote_ip_blocks,json=notRemoteIpBlocks,proto3" json:"not_remote_ip_blocks,omitempty"`
	// contains filtered or unexported fields
}