istio-api-rs 0.12.0

A collection of CRDs for api used in Istio.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium -Af resources/istio/v1_21_0/security/v1/AuthorizationPolicy.yaml --api-version v1
// kopium version: 0.22.5

#[allow(unused_imports)]
mod prelude {
    pub use kube::CustomResource;
    pub use schemars::JsonSchema;
    pub use serde::{Serialize, Deserialize};
    pub use std::collections::BTreeMap;
}
use self::prelude::*;

/// Configuration for access control on workloads. See more details at: <https://istio.io/docs/reference/config/security/authorization-policy.html>
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, JsonSchema)]
#[kube(group = "security.istio.io", version = "v1", kind = "AuthorizationPolicy", plural = "authorizationpolicies")]
#[kube(namespaced)]
pub struct AuthorizationPolicySpec {
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub action: Option<AuthorizationPolicyAction>,
    /// Specifies detailed configuration of the CUSTOM action.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<AuthorizationPolicyProvider>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rules: Option<Vec<AuthorizationPolicyRules>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub selector: Option<AuthorizationPolicySelector>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetRef")]
    pub target_ref: Option<AuthorizationPolicyTargetRef>,
}

/// Configuration for access control on workloads. See more details at: <https://istio.io/docs/reference/config/security/authorization-policy.html>
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum AuthorizationPolicyAction {
    #[serde(rename = "ALLOW")]
    Allow,
    #[serde(rename = "DENY")]
    Deny,
    #[serde(rename = "AUDIT")]
    Audit,
    #[serde(rename = "CUSTOM")]
    Custom,
}

/// Specifies detailed configuration of the CUSTOM action.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyProvider {
    /// Specifies the name of the extension provider.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyRules {
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub from: Option<Vec<AuthorizationPolicyRulesFrom>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub to: Option<Vec<AuthorizationPolicyRulesTo>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub when: Option<Vec<AuthorizationPolicyRulesWhen>>,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyRulesFrom {
    /// Source specifies the source of a request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub source: Option<AuthorizationPolicyRulesFromSource>,
}

/// Source specifies the source of a request.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyRulesFromSource {
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ipBlocks")]
    pub ip_blocks: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notIpBlocks")]
    pub not_ip_blocks: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notNamespaces")]
    pub not_namespaces: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notPrincipals")]
    pub not_principals: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notRemoteIpBlocks")]
    pub not_remote_ip_blocks: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notRequestPrincipals")]
    pub not_request_principals: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub principals: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "remoteIpBlocks")]
    pub remote_ip_blocks: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "requestPrincipals")]
    pub request_principals: Option<Vec<String>>,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyRulesTo {
    /// Operation specifies the operation of a request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub operation: Option<AuthorizationPolicyRulesToOperation>,
}

/// Operation specifies the operation of a request.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyRulesToOperation {
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub hosts: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub methods: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notHosts")]
    pub not_hosts: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notMethods")]
    pub not_methods: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notPaths")]
    pub not_paths: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notPorts")]
    pub not_ports: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub paths: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ports: Option<Vec<String>>,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyRulesWhen {
    /// The name of an Istio attribute.
    pub key: String,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notValues")]
    pub not_values: Option<Vec<String>>,
    /// Optional.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Optional.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicySelector {
    /// One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// Optional.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct AuthorizationPolicyTargetRef {
    /// group is the group of the target resource.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub group: Option<String>,
    /// kind is kind of the target resource.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kind: Option<String>,
    /// name is the name of the target resource.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// namespace is the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}