istio-api-rs 0.12.0

A collection of CRDs for api used in Istio.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium -Af resources/istio/v1_22_0/networking/v1alpha3/Gateway.yaml --api-version v1alpha3
// kopium version: 0.22.5

#[allow(unused_imports)]
mod prelude {
    pub use kube::CustomResource;
    pub use schemars::JsonSchema;
    pub use serde::{Serialize, Deserialize};
    pub use std::collections::BTreeMap;
}
use self::prelude::*;

/// Configuration affecting edge load balancer. See more details at: <https://istio.io/docs/reference/config/networking/gateway.html>
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, JsonSchema)]
#[kube(group = "networking.istio.io", version = "v1alpha3", kind = "Gateway", plural = "gateways")]
#[kube(namespaced)]
pub struct GatewaySpec {
    /// One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub selector: Option<BTreeMap<String, String>>,
    /// A list of server specifications.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub servers: Option<Vec<GatewayServers>>,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct GatewayServers {
    /// The ip or the Unix domain socket to which the listener should be bound to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub bind: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "defaultEndpoint")]
    pub default_endpoint: Option<String>,
    /// One or more hosts exposed by this gateway.
    pub hosts: Vec<String>,
    /// An optional name of the server, when set must be unique across all servers.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The Port on which the proxy should listen for incoming connections.
    pub port: GatewayServersPort,
    /// Set of TLS related options that govern the server's behavior.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tls: Option<GatewayServersTls>,
}

/// The Port on which the proxy should listen for incoming connections.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct GatewayServersPort {
    /// Label assigned to the port.
    pub name: String,
    /// A valid non-negative integer port number.
    pub number: i64,
    /// The protocol exposed on the port.
    pub protocol: String,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "targetPort")]
    pub target_port: Option<i64>,
}

/// Set of TLS related options that govern the server's behavior.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct GatewayServersTls {
    /// REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caCertificates")]
    pub ca_certificates: Option<String>,
    /// OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caCrl")]
    pub ca_crl: Option<String>,
    /// Optional: If specified, only support the specified cipher list.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "cipherSuites")]
    pub cipher_suites: Option<Vec<String>>,
    /// For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "credentialName")]
    pub credential_name: Option<String>,
    /// If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "httpsRedirect")]
    pub https_redirect: Option<bool>,
    /// Optional: Maximum TLS protocol version.
    /// 
    /// Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "maxProtocolVersion")]
    pub max_protocol_version: Option<GatewayServersTlsMaxProtocolVersion>,
    /// Optional: Minimum TLS protocol version.
    /// 
    /// Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "minProtocolVersion")]
    pub min_protocol_version: Option<GatewayServersTlsMinProtocolVersion>,
    /// Optional: Indicates whether connections to this port should be secured using TLS.
    /// 
    /// Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub mode: Option<GatewayServersTlsMode>,
    /// REQUIRED if mode is `SIMPLE` or `MUTUAL`.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "privateKey")]
    pub private_key: Option<String>,
    /// REQUIRED if mode is `SIMPLE` or `MUTUAL`.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serverCertificate")]
    pub server_certificate: Option<String>,
    /// A list of alternate names to verify the subject identity in the certificate presented by the client.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "subjectAltNames")]
    pub subject_alt_names: Option<Vec<String>>,
    /// An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "verifyCertificateHash")]
    pub verify_certificate_hash: Option<Vec<String>>,
    /// An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "verifyCertificateSpki")]
    pub verify_certificate_spki: Option<Vec<String>>,
}

/// Set of TLS related options that govern the server's behavior.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum GatewayServersTlsMaxProtocolVersion {
    #[serde(rename = "TLS_AUTO")]
    TlsAuto,
    #[serde(rename = "TLSV1_0")]
    Tlsv10,
    #[serde(rename = "TLSV1_1")]
    Tlsv11,
    #[serde(rename = "TLSV1_2")]
    Tlsv12,
    #[serde(rename = "TLSV1_3")]
    Tlsv13,
}

/// Set of TLS related options that govern the server's behavior.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum GatewayServersTlsMinProtocolVersion {
    #[serde(rename = "TLS_AUTO")]
    TlsAuto,
    #[serde(rename = "TLSV1_0")]
    Tlsv10,
    #[serde(rename = "TLSV1_1")]
    Tlsv11,
    #[serde(rename = "TLSV1_2")]
    Tlsv12,
    #[serde(rename = "TLSV1_3")]
    Tlsv13,
}

/// Set of TLS related options that govern the server's behavior.
#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub enum GatewayServersTlsMode {
    #[serde(rename = "PASSTHROUGH")]
    Passthrough,
    #[serde(rename = "SIMPLE")]
    Simple,
    #[serde(rename = "MUTUAL")]
    Mutual,
    #[serde(rename = "AUTO_PASSTHROUGH")]
    AutoPassthrough,
    #[serde(rename = "ISTIO_MUTUAL")]
    IstioMutual,
    #[serde(rename = "OPTIONAL_MUTUAL")]
    OptionalMutual,
}