//! tatara-cilium — auto-generated tatara domain.
//!
//! Tatara domain wrapping 1 CRD(s).
//!
//! Generated by `tatara-domain-forge`. Do not hand-edit.
//! Re-run the generator to refresh.
#![allow(clippy::module_name_repetitions)]
use serde::{Deserialize, Serialize};
use tatara_lisp_derive::TataraDomain;
/// CiliumNetworkPolicy is a Kubernetes third-party resource with an extended version of NetworkPolicy.
#[derive(Debug, Clone, Serialize, Deserialize, TataraDomain)]
#[tatara(keyword = "defciliumnetworkpolicy")]
pub struct CiliumNetworkPolicySpec {
/// Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment.
#[serde(default)]
pub description: Option<String>,
/// Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress.
#[serde(default)]
pub egress: Option<Vec<CiliumNetworkPolicyEgressItem>>,
/// EgressDeny is a list of EgressDenyRule which are enforced at egress. Any rule inserted here will be denied regardless of the allowed egress rules in the 'egress' field. If omitted or empty, this rule does not apply at egress.
#[serde(default)]
pub egress_deny: Option<Vec<CiliumNetworkPolicyEgressDenyItem>>,
/// EnableDefaultDeny determines whether this policy configures the subject endpoint(s) to have a default deny mode. If enabled, this causes all traffic not explicitly allowed by a network policy to be dropped.
/// If not specified, the default is true for each traffic direction that has rules, and false otherwise. For example, if a policy only has Ingress or IngressDeny rules, then the default for ingress is true and egress is false.
/// If multiple policies apply to an endpoint, that endpoint's default deny will be enabled if any policy requests it.
/// This is useful for creating broad-based network policies that will not cause endpoints to enter default-deny mode.
#[serde(default)]
pub enable_default_deny: Option<CiliumNetworkPolicyEnableDefaultDeny>,
/// EndpointSelector selects all endpoints which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive.
#[serde(default)]
pub endpoint_selector: Option<CiliumNetworkPolicyEndpointSelector>,
/// Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress.
#[serde(default)]
pub ingress: Option<Vec<CiliumNetworkPolicyIngressItem>>,
/// IngressDeny is a list of IngressDenyRule which are enforced at ingress. Any rule inserted here will be denied regardless of the allowed ingress rules in the 'ingress' field. If omitted or empty, this rule does not apply at ingress.
#[serde(default)]
pub ingress_deny: Option<Vec<CiliumNetworkPolicyIngressDenyItem>>,
/// Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels.
#[serde(default)]
pub labels: Option<Vec<CiliumNetworkPolicyLabelsItem>>,
/// NodeSelector selects all nodes which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
#[serde(default)]
pub node_selector: Option<CiliumNetworkPolicyNodeSelector>,
}
// ── Nested types ──────────────────────────────────────
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemAuthenticationModeKind {
#[serde(rename = "disabled")]
Disabled,
#[serde(rename = "required")]
Required,
#[serde(rename = "test-always-fail")]
TestAlwaysFail,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemAuthentication {
/// Mode is the required authentication mode for the allowed traffic, if any.
pub mode: CiliumNetworkPolicyEgressItemAuthenticationModeKind,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemIcmpsItemFieldsItemFamilyKind {
#[serde(rename = "IPv4")]
IPv4,
#[serde(rename = "IPv6")]
IPv6,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemIcmpsItemFieldsItem {
/// Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.
#[serde(default)]
pub family: Option<CiliumNetworkPolicyEgressItemIcmpsItemFieldsItemFamilyKind>,
/// Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply
pub r#type: serde_json::Value,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemIcmpsItem {
/// Fields is a list of ICMP fields.
#[serde(default)]
pub fields: Option<Vec<CiliumNetworkPolicyEgressItemIcmpsItemFieldsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToCIDRSetItem {
/// CIDR is a CIDR prefix / IP Block.
#[serde(default)]
pub cidr: Option<String>,
/// CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.
#[serde(default)]
pub cidr_group_ref: Option<String>,
/// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
#[serde(default)]
pub except: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToEndpointsItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToEndpointsItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressItemToEndpointsItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToEndpointsItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressItemToEndpointsItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToEntitiesItemKind {
#[serde(rename = "all")]
All,
#[serde(rename = "world")]
World,
#[serde(rename = "cluster")]
Cluster,
#[serde(rename = "host")]
Host,
#[serde(rename = "init")]
Init,
#[serde(rename = "ingress")]
Ingress,
#[serde(rename = "unmanaged")]
Unmanaged,
#[serde(rename = "remote-node")]
RemoteNode,
#[serde(rename = "health")]
Health,
#[serde(rename = "none")]
None,
#[serde(rename = "kube-apiserver")]
KubeApiserver,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToFQDNsItem {
/// MatchName matches literal DNS names. A trailing "." is automatically added when missing.
#[serde(default)]
pub match_name: Option<String>,
/// MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - "*" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a "*" as the leftmost character, without a following "." matches all subdomains as well as the name to the right. A trailing "." is automatically added when missing.
/// Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io" except those containing "." separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with "sub" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not
#[serde(default)]
pub match_pattern: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToGroupsItemAws {
#[serde(default)]
pub labels: Option<std::collections::HashMap<String, String>>,
#[serde(default)]
pub region: Option<String>,
#[serde(default)]
pub security_groups_ids: Option<Vec<String>>,
#[serde(default)]
pub security_groups_names: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToGroupsItem {
/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[serde(default)]
pub aws: Option<CiliumNetworkPolicyEgressItemToGroupsItemAws>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToNodesItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToNodesItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressItemToNodesItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToNodesItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressItemToNodesItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToPortsItemListenerEnvoyConfigKindKind {
#[serde(rename = "CiliumEnvoyConfig")]
CiliumEnvoyConfig,
#[serde(rename = "CiliumClusterwideEnvoyConfig")]
CiliumClusterwideEnvoyConfig,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemListenerEnvoyConfig {
/// Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, respectively. The only case this is currently explicitly needed is when referring to a CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener from a cluster scoped policy is not allowed.
#[serde(default)]
pub kind: Option<CiliumNetworkPolicyEgressItemToPortsItemListenerEnvoyConfigKindKind>,
/// Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where the listener is defined in.
pub name: String,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemListener {
/// EnvoyConfig is a reference to the CEC or CCEC resource in which the listener is defined.
pub envoy_config: CiliumNetworkPolicyEgressItemToPortsItemListenerEnvoyConfig,
/// Name is the name of the listener.
pub name: String,
/// Priority for this Listener that is used when multiple rules would apply different listeners to a policy map entry. Behavior of this is implementation dependent.
#[serde(default)]
pub priority: Option<i64>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemOriginatingTLSSecret {
/// Name is the name of the secret.
pub name: String,
/// Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., "default").
#[serde(default)]
pub namespace: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemOriginatingTLS {
/// Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub certificate: Option<String>,
/// PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub private_key: Option<String>,
/// Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.
pub secret: CiliumNetworkPolicyEgressItemToPortsItemOriginatingTLSSecret,
/// TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub trusted_c_a: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToPortsItemPortsItemProtocolKind {
#[serde(rename = "TCP")]
TCP,
#[serde(rename = "UDP")]
UDP,
#[serde(rename = "SCTP")]
SCTP,
#[serde(rename = "ANY")]
ANY,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemPortsItem {
/// EndPort can only be an L4 port number.
#[serde(default)]
pub end_port: Option<i64>,
/// Port can be an L4 port number, or a name in the form of "http" or "http-8080".
pub port: String,
/// Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", "SCTP", "ANY"
/// Matching on ICMP is not supported.
/// Named port specified for a container may narrow this down, but may not contradict this.
#[serde(default)]
pub protocol: Option<CiliumNetworkPolicyEgressItemToPortsItemPortsItemProtocolKind>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemRulesDnsItem {
/// MatchName matches literal DNS names. A trailing "." is automatically added when missing.
#[serde(default)]
pub match_name: Option<String>,
/// MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - "*" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a "*" as the leftmost character, without a following "." matches all subdomains as well as the name to the right. A trailing "." is automatically added when missing.
/// Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io" except those containing "." separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with "sub" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not
#[serde(default)]
pub match_pattern: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItemHeaderMatchesItemMismatchKind {
#[serde(rename = "LOG")]
LOG,
#[serde(rename = "ADD")]
ADD,
#[serde(rename = "DELETE")]
DELETE,
#[serde(rename = "REPLACE")]
REPLACE,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItemHeaderMatchesItemSecret {
/// Name is the name of the secret.
pub name: String,
/// Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., "default").
#[serde(default)]
pub namespace: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItemHeaderMatchesItem {
/// Mismatch identifies what to do in case there is no match. The default is to drop the request. Otherwise the overall rule is still considered as matching, but the mismatches are logged in the access log.
#[serde(default)]
pub mismatch: Option<CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItemHeaderMatchesItemMismatchKind>,
/// Name identifies the header.
pub name: String,
/// Secret refers to a secret that contains the value to be matched against. The secret must only contain one entry. If the referred secret does not exist, and there is no "Value" specified, the match will fail.
#[serde(default)]
pub secret: Option<CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItemHeaderMatchesItemSecret>,
/// Value matches the exact value of the header. Can be specified either alone or together with "Secret"; will be used as the header value if the secret can not be found in the latter case.
#[serde(default)]
pub value: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItem {
/// HeaderMatches is a list of HTTP headers which must be present and match against the given values. Mismatch field can be used to specify what to do when there is no match.
#[serde(default)]
pub header_matches: Option<Vec<CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItemHeaderMatchesItem>>,
/// Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
#[serde(default)]
pub headers: Option<Vec<String>>,
/// Host is an extended POSIX regex matched against the host header of a request. Examples:
/// - foo.bar.com will match the host fooXbar.com or foo-bar.com - foo\.bar\.com will only match the host foo.bar.com
/// If omitted or empty, the value of the host header is ignored.
#[serde(default)]
pub host: Option<String>,
/// Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
/// If omitted or empty, all methods are allowed.
#[serde(default)]
pub method: Option<String>,
/// Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986.
/// If omitted or empty, all paths are all allowed.
#[serde(default)]
pub path: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToPortsItemRulesKafkaItemRoleKind {
#[serde(rename = "produce")]
Produce,
#[serde(rename = "consume")]
Consume,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemRulesKafkaItem {
/// APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys
/// If omitted or empty, and if Role is not specified, then all keys are allowed.
#[serde(default)]
pub api_key: Option<String>,
/// APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer.
/// If omitted or empty, all versions are allowed.
#[serde(default)]
pub api_version: Option<String>,
/// ClientID is the client identifier as provided in the request.
/// From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client.
/// If omitted or empty, all client identifiers are allowed.
#[serde(default)]
pub client_i_d: Option<String>,
/// Role is a case-insensitive string and describes a group of API keys necessary to perform certain higher-level Kafka operations such as "produce" or "consume". A Role automatically expands into all APIKeys required to perform the specified higher-level operation.
/// The following values are supported: - "produce": Allow producing to the topics specified in the rule - "consume": Allow consuming from the topics specified in the rule
/// This field is incompatible with the APIKey field, i.e APIKey and Role cannot both be specified in the same rule.
/// If omitted or empty, and if APIKey is not specified, then all keys are allowed.
#[serde(default)]
pub role: Option<CiliumNetworkPolicyEgressItemToPortsItemRulesKafkaItemRoleKind>,
/// Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected.
/// This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _.
/// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255.
/// If omitted or empty, all topics are allowed.
#[serde(default)]
pub topic: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemRules {
/// DNS-specific rules.
#[serde(default)]
pub dns: Option<Vec<CiliumNetworkPolicyEgressItemToPortsItemRulesDnsItem>>,
/// HTTP specific rules.
#[serde(default)]
pub http: Option<Vec<CiliumNetworkPolicyEgressItemToPortsItemRulesHttpItem>>,
/// Kafka-specific rules.
#[serde(default)]
pub kafka: Option<Vec<CiliumNetworkPolicyEgressItemToPortsItemRulesKafkaItem>>,
/// Key-value pair rules.
#[serde(default)]
pub l7: Option<Vec<std::collections::HashMap<String, String>>>,
/// Name of the L7 protocol for which the Key-value pair rules apply.
#[serde(default)]
pub l7proto: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemTerminatingTLSSecret {
/// Name is the name of the secret.
pub name: String,
/// Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., "default").
#[serde(default)]
pub namespace: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItemTerminatingTLS {
/// Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub certificate: Option<String>,
/// PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub private_key: Option<String>,
/// Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.
pub secret: CiliumNetworkPolicyEgressItemToPortsItemTerminatingTLSSecret,
/// TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub trusted_c_a: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToPortsItem {
/// listener specifies the name of a custom Envoy listener to which this traffic should be redirected to.
#[serde(default)]
pub listener: Option<CiliumNetworkPolicyEgressItemToPortsItemListener>,
/// OriginatingTLS is the TLS context for the connections originated by the L7 proxy. For egress policy this specifies the client-side TLS parameters for the upstream connection originating from the L7 proxy to the remote destination. For ingress policy this specifies the client-side TLS parameters for the connection from the L7 proxy to the local endpoint.
#[serde(default)]
pub originating_t_l_s: Option<CiliumNetworkPolicyEgressItemToPortsItemOriginatingTLS>,
/// Ports is a list of L4 port/protocol
#[serde(default)]
pub ports: Option<Vec<CiliumNetworkPolicyEgressItemToPortsItemPortsItem>>,
/// Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
#[serde(default)]
pub rules: Option<CiliumNetworkPolicyEgressItemToPortsItemRules>,
/// ServerNames is a list of allowed TLS SNI values. If not empty, then TLS must be present and one of the provided SNIs must be indicated in the TLS handshake.
#[serde(default)]
pub server_names: Option<Vec<String>>,
/// TerminatingTLS is the TLS context for the connection terminated by the L7 proxy. For egress policy this specifies the server-side TLS parameters to be applied on the connections originated from the local endpoint and terminated by the L7 proxy. For ingress policy this specifies the server-side TLS parameters to be applied on the connections originated from a remote source and terminated by the L7 proxy.
#[serde(default)]
pub terminating_t_l_s: Option<CiliumNetworkPolicyEgressItemToPortsItemTerminatingTLS>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToRequiresItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToRequiresItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressItemToRequiresItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToRequiresItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressItemToRequiresItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToServicesItemK8sService {
#[serde(default)]
pub namespace: Option<String>,
#[serde(default)]
pub service_name: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelectorSelector {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelector {
#[serde(default)]
pub namespace: Option<String>,
/// ServiceSelector is a label selector for k8s services
pub selector: CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelectorSelector,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItemToServicesItem {
/// K8sService selects service by name and namespace pair
#[serde(default)]
pub k8s_service: Option<CiliumNetworkPolicyEgressItemToServicesItemK8sService>,
/// K8sServiceSelector selects services by k8s labels and namespace
#[serde(default)]
pub k8s_service_selector: Option<CiliumNetworkPolicyEgressItemToServicesItemK8sServiceSelector>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressItem {
/// Authentication is the required authentication type for the allowed traffic, if any.
#[serde(default)]
pub authentication: Option<CiliumNetworkPolicyEgressItemAuthentication>,
/// ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to connect to.
/// Example: Any endpoint with the label "app=httpd" is allowed to initiate type 8 ICMP connections.
#[serde(default)]
pub icmps: Option<Vec<CiliumNetworkPolicyEgressItemIcmpsItem>>,
/// ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet.
/// Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
#[serde(default)]
pub to_c_i_d_r: Option<Vec<String>>,
/// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet.
/// Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
#[serde(default)]
pub to_c_i_d_r_set: Option<Vec<CiliumNetworkPolicyEgressItemToCIDRSetItem>>,
/// ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate.
/// Example: Any endpoint with the label "role=frontend" can communicate with any endpoint carrying the label "role=backend".
#[serde(default)]
pub to_endpoints: Option<Vec<CiliumNetworkPolicyEgressItemToEndpointsItem>>,
/// ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`,`host`,`remote-node`,`kube-apiserver`, `init`, `health`,`unmanaged` and `all`.
#[serde(default)]
pub to_entities: Option<Vec<CiliumNetworkPolicyEgressItemToEntitiesItemKind>>,
/// ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result from DNS resolution of `ToFQDN.MatchName`s are added to the same EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and L7 rules within this EgressRule will also apply to these IPs. The DNS -> IP mapping is re-resolved periodically from within the cilium-agent, and the IPs in the DNS response are effected in the policy for selected pods as-is (i.e. the list of IPs is not modified in any way). Note: An explicit rule to allow for DNS traffic is needed for the pods, as ToFQDN counts as an egress rule and will enforce egress policy when PolicyEnforcment=default. Note: If the resolved IPs are IPs within the kubernetes cluster, the ToFQDN rule will not apply to that IP. Note: ToFQDN cannot occur in the same policy as other To* rules.
#[serde(default)]
pub to_f_q_d_ns: Option<Vec<CiliumNetworkPolicyEgressItemToFQDNsItem>>,
/// ToGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives:
/// Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'
#[serde(default)]
pub to_groups: Option<Vec<CiliumNetworkPolicyEgressItemToGroupsItem>>,
/// ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.
#[serde(default)]
pub to_nodes: Option<Vec<CiliumNetworkPolicyEgressItemToNodesItem>>,
/// ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to.
/// Example: Any endpoint with the label "role=frontend" is allowed to initiate connections to destination port 8080/tcp
#[serde(default)]
pub to_ports: Option<Vec<CiliumNetworkPolicyEgressItemToPortsItem>>,
/// ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to connect to other endpoints. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching ToEndpoints.
/// Example: Any Endpoint with the label "team=A" requires any endpoint to which it communicates to also carry the label "team=A".
#[serde(default)]
pub to_requires: Option<Vec<CiliumNetworkPolicyEgressItemToRequiresItem>>,
/// ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services without selectors.
/// Example: Any endpoint with the label "app=backend-app" is allowed to initiate connections to all cidrs backing the "external-service" service
#[serde(default)]
pub to_services: Option<Vec<CiliumNetworkPolicyEgressItemToServicesItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemIcmpsItemFieldsItemFamilyKind {
#[serde(rename = "IPv4")]
IPv4,
#[serde(rename = "IPv6")]
IPv6,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemIcmpsItemFieldsItem {
/// Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.
#[serde(default)]
pub family: Option<CiliumNetworkPolicyEgressDenyItemIcmpsItemFieldsItemFamilyKind>,
/// Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply
pub r#type: serde_json::Value,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemIcmpsItem {
/// Fields is a list of ICMP fields.
#[serde(default)]
pub fields: Option<Vec<CiliumNetworkPolicyEgressDenyItemIcmpsItemFieldsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToCIDRSetItem {
/// CIDR is a CIDR prefix / IP Block.
#[serde(default)]
pub cidr: Option<String>,
/// CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.
#[serde(default)]
pub cidr_group_ref: Option<String>,
/// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
#[serde(default)]
pub except: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemToEndpointsItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToEndpointsItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressDenyItemToEndpointsItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToEndpointsItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressDenyItemToEndpointsItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemToEntitiesItemKind {
#[serde(rename = "all")]
All,
#[serde(rename = "world")]
World,
#[serde(rename = "cluster")]
Cluster,
#[serde(rename = "host")]
Host,
#[serde(rename = "init")]
Init,
#[serde(rename = "ingress")]
Ingress,
#[serde(rename = "unmanaged")]
Unmanaged,
#[serde(rename = "remote-node")]
RemoteNode,
#[serde(rename = "health")]
Health,
#[serde(rename = "none")]
None,
#[serde(rename = "kube-apiserver")]
KubeApiserver,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToGroupsItemAws {
#[serde(default)]
pub labels: Option<std::collections::HashMap<String, String>>,
#[serde(default)]
pub region: Option<String>,
#[serde(default)]
pub security_groups_ids: Option<Vec<String>>,
#[serde(default)]
pub security_groups_names: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToGroupsItem {
/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[serde(default)]
pub aws: Option<CiliumNetworkPolicyEgressDenyItemToGroupsItemAws>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemToNodesItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToNodesItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressDenyItemToNodesItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToNodesItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressDenyItemToNodesItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemToPortsItemPortsItemProtocolKind {
#[serde(rename = "TCP")]
TCP,
#[serde(rename = "UDP")]
UDP,
#[serde(rename = "SCTP")]
SCTP,
#[serde(rename = "ANY")]
ANY,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToPortsItemPortsItem {
/// EndPort can only be an L4 port number.
#[serde(default)]
pub end_port: Option<i64>,
/// Port can be an L4 port number, or a name in the form of "http" or "http-8080".
pub port: String,
/// Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", "SCTP", "ANY"
/// Matching on ICMP is not supported.
/// Named port specified for a container may narrow this down, but may not contradict this.
#[serde(default)]
pub protocol: Option<CiliumNetworkPolicyEgressDenyItemToPortsItemPortsItemProtocolKind>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToPortsItem {
/// Ports is a list of L4 port/protocol
#[serde(default)]
pub ports: Option<Vec<CiliumNetworkPolicyEgressDenyItemToPortsItemPortsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemToRequiresItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToRequiresItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressDenyItemToRequiresItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToRequiresItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressDenyItemToRequiresItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToServicesItemK8sService {
#[serde(default)]
pub namespace: Option<String>,
#[serde(default)]
pub service_name: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelectorSelector {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelectorSelectorMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelector {
#[serde(default)]
pub namespace: Option<String>,
/// ServiceSelector is a label selector for k8s services
pub selector: CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelectorSelector,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItemToServicesItem {
/// K8sService selects service by name and namespace pair
#[serde(default)]
pub k8s_service: Option<CiliumNetworkPolicyEgressDenyItemToServicesItemK8sService>,
/// K8sServiceSelector selects services by k8s labels and namespace
#[serde(default)]
pub k8s_service_selector: Option<CiliumNetworkPolicyEgressDenyItemToServicesItemK8sServiceSelector>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEgressDenyItem {
/// ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is not allowed to connect to.
/// Example: Any endpoint with the label "app=httpd" is not allowed to initiate type 8 ICMP connections.
#[serde(default)]
pub icmps: Option<Vec<CiliumNetworkPolicyEgressDenyItemIcmpsItem>>,
/// ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet.
/// Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
#[serde(default)]
pub to_c_i_d_r: Option<Vec<String>>,
/// ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet.
/// Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
#[serde(default)]
pub to_c_i_d_r_set: Option<Vec<CiliumNetworkPolicyEgressDenyItemToCIDRSetItem>>,
/// ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate.
/// Example: Any endpoint with the label "role=frontend" can communicate with any endpoint carrying the label "role=backend".
#[serde(default)]
pub to_endpoints: Option<Vec<CiliumNetworkPolicyEgressDenyItemToEndpointsItem>>,
/// ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`,`host`,`remote-node`,`kube-apiserver`, `init`, `health`,`unmanaged` and `all`.
#[serde(default)]
pub to_entities: Option<Vec<CiliumNetworkPolicyEgressDenyItemToEntitiesItemKind>>,
/// ToGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives:
/// Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'
#[serde(default)]
pub to_groups: Option<Vec<CiliumNetworkPolicyEgressDenyItemToGroupsItem>>,
/// ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.
#[serde(default)]
pub to_nodes: Option<Vec<CiliumNetworkPolicyEgressDenyItemToNodesItem>>,
/// ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is not allowed to connect to.
/// Example: Any endpoint with the label "role=frontend" is not allowed to initiate connections to destination port 8080/tcp
#[serde(default)]
pub to_ports: Option<Vec<CiliumNetworkPolicyEgressDenyItemToPortsItem>>,
/// ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to connect to other endpoints. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching ToEndpoints.
/// Example: Any Endpoint with the label "team=A" requires any endpoint to which it communicates to also carry the label "team=A".
#[serde(default)]
pub to_requires: Option<Vec<CiliumNetworkPolicyEgressDenyItemToRequiresItem>>,
/// ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services without selectors.
/// Example: Any endpoint with the label "app=backend-app" is allowed to initiate connections to all cidrs backing the "external-service" service
#[serde(default)]
pub to_services: Option<Vec<CiliumNetworkPolicyEgressDenyItemToServicesItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEnableDefaultDeny {
/// Whether or not the endpoint should have a default-deny rule applied to egress traffic.
#[serde(default)]
pub egress: Option<bool>,
/// Whether or not the endpoint should have a default-deny rule applied to ingress traffic.
#[serde(default)]
pub ingress: Option<bool>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyEndpointSelectorMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEndpointSelectorMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyEndpointSelectorMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyEndpointSelector {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyEndpointSelectorMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemAuthenticationModeKind {
#[serde(rename = "disabled")]
Disabled,
#[serde(rename = "required")]
Required,
#[serde(rename = "test-always-fail")]
TestAlwaysFail,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemAuthentication {
/// Mode is the required authentication mode for the allowed traffic, if any.
pub mode: CiliumNetworkPolicyIngressItemAuthenticationModeKind,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromCIDRSetItem {
/// CIDR is a CIDR prefix / IP Block.
#[serde(default)]
pub cidr: Option<String>,
/// CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.
#[serde(default)]
pub cidr_group_ref: Option<String>,
/// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
#[serde(default)]
pub except: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemFromEndpointsItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromEndpointsItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyIngressItemFromEndpointsItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromEndpointsItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressItemFromEndpointsItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemFromEntitiesItemKind {
#[serde(rename = "all")]
All,
#[serde(rename = "world")]
World,
#[serde(rename = "cluster")]
Cluster,
#[serde(rename = "host")]
Host,
#[serde(rename = "init")]
Init,
#[serde(rename = "ingress")]
Ingress,
#[serde(rename = "unmanaged")]
Unmanaged,
#[serde(rename = "remote-node")]
RemoteNode,
#[serde(rename = "health")]
Health,
#[serde(rename = "none")]
None,
#[serde(rename = "kube-apiserver")]
KubeApiserver,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromGroupsItemAws {
#[serde(default)]
pub labels: Option<std::collections::HashMap<String, String>>,
#[serde(default)]
pub region: Option<String>,
#[serde(default)]
pub security_groups_ids: Option<Vec<String>>,
#[serde(default)]
pub security_groups_names: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromGroupsItem {
/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[serde(default)]
pub aws: Option<CiliumNetworkPolicyIngressItemFromGroupsItemAws>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemFromNodesItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromNodesItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyIngressItemFromNodesItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromNodesItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressItemFromNodesItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemFromRequiresItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromRequiresItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyIngressItemFromRequiresItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemFromRequiresItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressItemFromRequiresItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemIcmpsItemFieldsItemFamilyKind {
#[serde(rename = "IPv4")]
IPv4,
#[serde(rename = "IPv6")]
IPv6,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemIcmpsItemFieldsItem {
/// Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.
#[serde(default)]
pub family: Option<CiliumNetworkPolicyIngressItemIcmpsItemFieldsItemFamilyKind>,
/// Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply
pub r#type: serde_json::Value,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemIcmpsItem {
/// Fields is a list of ICMP fields.
#[serde(default)]
pub fields: Option<Vec<CiliumNetworkPolicyIngressItemIcmpsItemFieldsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemToPortsItemListenerEnvoyConfigKindKind {
#[serde(rename = "CiliumEnvoyConfig")]
CiliumEnvoyConfig,
#[serde(rename = "CiliumClusterwideEnvoyConfig")]
CiliumClusterwideEnvoyConfig,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemListenerEnvoyConfig {
/// Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, respectively. The only case this is currently explicitly needed is when referring to a CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener from a cluster scoped policy is not allowed.
#[serde(default)]
pub kind: Option<CiliumNetworkPolicyIngressItemToPortsItemListenerEnvoyConfigKindKind>,
/// Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where the listener is defined in.
pub name: String,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemListener {
/// EnvoyConfig is a reference to the CEC or CCEC resource in which the listener is defined.
pub envoy_config: CiliumNetworkPolicyIngressItemToPortsItemListenerEnvoyConfig,
/// Name is the name of the listener.
pub name: String,
/// Priority for this Listener that is used when multiple rules would apply different listeners to a policy map entry. Behavior of this is implementation dependent.
#[serde(default)]
pub priority: Option<i64>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemOriginatingTLSSecret {
/// Name is the name of the secret.
pub name: String,
/// Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., "default").
#[serde(default)]
pub namespace: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemOriginatingTLS {
/// Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub certificate: Option<String>,
/// PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub private_key: Option<String>,
/// Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.
pub secret: CiliumNetworkPolicyIngressItemToPortsItemOriginatingTLSSecret,
/// TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub trusted_c_a: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemToPortsItemPortsItemProtocolKind {
#[serde(rename = "TCP")]
TCP,
#[serde(rename = "UDP")]
UDP,
#[serde(rename = "SCTP")]
SCTP,
#[serde(rename = "ANY")]
ANY,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemPortsItem {
/// EndPort can only be an L4 port number.
#[serde(default)]
pub end_port: Option<i64>,
/// Port can be an L4 port number, or a name in the form of "http" or "http-8080".
pub port: String,
/// Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", "SCTP", "ANY"
/// Matching on ICMP is not supported.
/// Named port specified for a container may narrow this down, but may not contradict this.
#[serde(default)]
pub protocol: Option<CiliumNetworkPolicyIngressItemToPortsItemPortsItemProtocolKind>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemRulesDnsItem {
/// MatchName matches literal DNS names. A trailing "." is automatically added when missing.
#[serde(default)]
pub match_name: Option<String>,
/// MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - "*" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a "*" as the leftmost character, without a following "." matches all subdomains as well as the name to the right. A trailing "." is automatically added when missing.
/// Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io" except those containing "." separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with "sub" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not
#[serde(default)]
pub match_pattern: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItemHeaderMatchesItemMismatchKind {
#[serde(rename = "LOG")]
LOG,
#[serde(rename = "ADD")]
ADD,
#[serde(rename = "DELETE")]
DELETE,
#[serde(rename = "REPLACE")]
REPLACE,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItemHeaderMatchesItemSecret {
/// Name is the name of the secret.
pub name: String,
/// Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., "default").
#[serde(default)]
pub namespace: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItemHeaderMatchesItem {
/// Mismatch identifies what to do in case there is no match. The default is to drop the request. Otherwise the overall rule is still considered as matching, but the mismatches are logged in the access log.
#[serde(default)]
pub mismatch: Option<CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItemHeaderMatchesItemMismatchKind>,
/// Name identifies the header.
pub name: String,
/// Secret refers to a secret that contains the value to be matched against. The secret must only contain one entry. If the referred secret does not exist, and there is no "Value" specified, the match will fail.
#[serde(default)]
pub secret: Option<CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItemHeaderMatchesItemSecret>,
/// Value matches the exact value of the header. Can be specified either alone or together with "Secret"; will be used as the header value if the secret can not be found in the latter case.
#[serde(default)]
pub value: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItem {
/// HeaderMatches is a list of HTTP headers which must be present and match against the given values. Mismatch field can be used to specify what to do when there is no match.
#[serde(default)]
pub header_matches: Option<Vec<CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItemHeaderMatchesItem>>,
/// Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
#[serde(default)]
pub headers: Option<Vec<String>>,
/// Host is an extended POSIX regex matched against the host header of a request. Examples:
/// - foo.bar.com will match the host fooXbar.com or foo-bar.com - foo\.bar\.com will only match the host foo.bar.com
/// If omitted or empty, the value of the host header is ignored.
#[serde(default)]
pub host: Option<String>,
/// Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
/// If omitted or empty, all methods are allowed.
#[serde(default)]
pub method: Option<String>,
/// Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986.
/// If omitted or empty, all paths are all allowed.
#[serde(default)]
pub path: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressItemToPortsItemRulesKafkaItemRoleKind {
#[serde(rename = "produce")]
Produce,
#[serde(rename = "consume")]
Consume,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemRulesKafkaItem {
/// APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys
/// If omitted or empty, and if Role is not specified, then all keys are allowed.
#[serde(default)]
pub api_key: Option<String>,
/// APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer.
/// If omitted or empty, all versions are allowed.
#[serde(default)]
pub api_version: Option<String>,
/// ClientID is the client identifier as provided in the request.
/// From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client.
/// If omitted or empty, all client identifiers are allowed.
#[serde(default)]
pub client_i_d: Option<String>,
/// Role is a case-insensitive string and describes a group of API keys necessary to perform certain higher-level Kafka operations such as "produce" or "consume". A Role automatically expands into all APIKeys required to perform the specified higher-level operation.
/// The following values are supported: - "produce": Allow producing to the topics specified in the rule - "consume": Allow consuming from the topics specified in the rule
/// This field is incompatible with the APIKey field, i.e APIKey and Role cannot both be specified in the same rule.
/// If omitted or empty, and if APIKey is not specified, then all keys are allowed.
#[serde(default)]
pub role: Option<CiliumNetworkPolicyIngressItemToPortsItemRulesKafkaItemRoleKind>,
/// Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected.
/// This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _.
/// Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255.
/// If omitted or empty, all topics are allowed.
#[serde(default)]
pub topic: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemRules {
/// DNS-specific rules.
#[serde(default)]
pub dns: Option<Vec<CiliumNetworkPolicyIngressItemToPortsItemRulesDnsItem>>,
/// HTTP specific rules.
#[serde(default)]
pub http: Option<Vec<CiliumNetworkPolicyIngressItemToPortsItemRulesHttpItem>>,
/// Kafka-specific rules.
#[serde(default)]
pub kafka: Option<Vec<CiliumNetworkPolicyIngressItemToPortsItemRulesKafkaItem>>,
/// Key-value pair rules.
#[serde(default)]
pub l7: Option<Vec<std::collections::HashMap<String, String>>>,
/// Name of the L7 protocol for which the Key-value pair rules apply.
#[serde(default)]
pub l7proto: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemTerminatingTLSSecret {
/// Name is the name of the secret.
pub name: String,
/// Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., "default").
#[serde(default)]
pub namespace: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItemTerminatingTLS {
/// Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub certificate: Option<String>,
/// PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub private_key: Option<String>,
/// Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.
pub secret: CiliumNetworkPolicyIngressItemToPortsItemTerminatingTLSSecret,
/// TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.
#[serde(default)]
pub trusted_c_a: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItemToPortsItem {
/// listener specifies the name of a custom Envoy listener to which this traffic should be redirected to.
#[serde(default)]
pub listener: Option<CiliumNetworkPolicyIngressItemToPortsItemListener>,
/// OriginatingTLS is the TLS context for the connections originated by the L7 proxy. For egress policy this specifies the client-side TLS parameters for the upstream connection originating from the L7 proxy to the remote destination. For ingress policy this specifies the client-side TLS parameters for the connection from the L7 proxy to the local endpoint.
#[serde(default)]
pub originating_t_l_s: Option<CiliumNetworkPolicyIngressItemToPortsItemOriginatingTLS>,
/// Ports is a list of L4 port/protocol
#[serde(default)]
pub ports: Option<Vec<CiliumNetworkPolicyIngressItemToPortsItemPortsItem>>,
/// Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
#[serde(default)]
pub rules: Option<CiliumNetworkPolicyIngressItemToPortsItemRules>,
/// ServerNames is a list of allowed TLS SNI values. If not empty, then TLS must be present and one of the provided SNIs must be indicated in the TLS handshake.
#[serde(default)]
pub server_names: Option<Vec<String>>,
/// TerminatingTLS is the TLS context for the connection terminated by the L7 proxy. For egress policy this specifies the server-side TLS parameters to be applied on the connections originated from the local endpoint and terminated by the L7 proxy. For ingress policy this specifies the server-side TLS parameters to be applied on the connections originated from a remote source and terminated by the L7 proxy.
#[serde(default)]
pub terminating_t_l_s: Option<CiliumNetworkPolicyIngressItemToPortsItemTerminatingTLS>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressItem {
/// Authentication is the required authentication type for the allowed traffic, if any.
#[serde(default)]
pub authentication: Option<CiliumNetworkPolicyIngressItemAuthentication>,
/// FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. Only connections which do *not* originate from the cluster or from the local host are subject to CIDR rules. In order to allow in-cluster connectivity, use the FromEndpoints field. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
/// Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.3.9.1
#[serde(default)]
pub from_c_i_d_r: Option<Vec<String>>,
/// FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
/// Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
#[serde(default)]
pub from_c_i_d_r_set: Option<Vec<CiliumNetworkPolicyIngressItemFromCIDRSetItem>>,
/// FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.
/// Example: Any endpoint with the label "role=backend" can be consumed by any endpoint carrying the label "role=frontend".
#[serde(default)]
pub from_endpoints: Option<Vec<CiliumNetworkPolicyIngressItemFromEndpointsItem>>,
/// FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster` and `host`
#[serde(default)]
pub from_entities: Option<Vec<CiliumNetworkPolicyIngressItemFromEntitiesItemKind>>,
/// FromGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives:
/// Example: FromGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'
#[serde(default)]
pub from_groups: Option<Vec<CiliumNetworkPolicyIngressItemFromGroupsItem>>,
/// FromNodes is a list of nodes identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.
#[serde(default)]
pub from_nodes: Option<Vec<CiliumNetworkPolicyIngressItemFromNodesItem>>,
/// FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints.
/// Example: Any Endpoint with the label "team=A" requires consuming endpoint to also carry the label "team=A".
#[serde(default)]
pub from_requires: Option<Vec<CiliumNetworkPolicyIngressItemFromRequiresItem>>,
/// ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to receive connections on.
/// Example: Any endpoint with the label "app=httpd" can only accept incoming type 8 ICMP connections.
#[serde(default)]
pub icmps: Option<Vec<CiliumNetworkPolicyIngressItemIcmpsItem>>,
/// ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on.
/// Example: Any endpoint with the label "app=httpd" can only accept incoming connections on port 80/tcp.
#[serde(default)]
pub to_ports: Option<Vec<CiliumNetworkPolicyIngressItemToPortsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromCIDRSetItem {
/// CIDR is a CIDR prefix / IP Block.
#[serde(default)]
pub cidr: Option<String>,
/// CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.
#[serde(default)]
pub cidr_group_ref: Option<String>,
/// ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
#[serde(default)]
pub except: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressDenyItemFromEndpointsItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromEndpointsItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyIngressDenyItemFromEndpointsItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromEndpointsItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromEndpointsItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressDenyItemFromEntitiesItemKind {
#[serde(rename = "all")]
All,
#[serde(rename = "world")]
World,
#[serde(rename = "cluster")]
Cluster,
#[serde(rename = "host")]
Host,
#[serde(rename = "init")]
Init,
#[serde(rename = "ingress")]
Ingress,
#[serde(rename = "unmanaged")]
Unmanaged,
#[serde(rename = "remote-node")]
RemoteNode,
#[serde(rename = "health")]
Health,
#[serde(rename = "none")]
None,
#[serde(rename = "kube-apiserver")]
KubeApiserver,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromGroupsItemAws {
#[serde(default)]
pub labels: Option<std::collections::HashMap<String, String>>,
#[serde(default)]
pub region: Option<String>,
#[serde(default)]
pub security_groups_ids: Option<Vec<String>>,
#[serde(default)]
pub security_groups_names: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromGroupsItem {
/// AWSGroup is an structure that can be used to whitelisting information from AWS integration
#[serde(default)]
pub aws: Option<CiliumNetworkPolicyIngressDenyItemFromGroupsItemAws>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressDenyItemFromNodesItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromNodesItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyIngressDenyItemFromNodesItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromNodesItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromNodesItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressDenyItemFromRequiresItemMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromRequiresItemMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyIngressDenyItemFromRequiresItemMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemFromRequiresItem {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromRequiresItemMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressDenyItemIcmpsItemFieldsItemFamilyKind {
#[serde(rename = "IPv4")]
IPv4,
#[serde(rename = "IPv6")]
IPv6,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemIcmpsItemFieldsItem {
/// Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.
#[serde(default)]
pub family: Option<CiliumNetworkPolicyIngressDenyItemIcmpsItemFieldsItemFamilyKind>,
/// Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply
pub r#type: serde_json::Value,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemIcmpsItem {
/// Fields is a list of ICMP fields.
#[serde(default)]
pub fields: Option<Vec<CiliumNetworkPolicyIngressDenyItemIcmpsItemFieldsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyIngressDenyItemToPortsItemPortsItemProtocolKind {
#[serde(rename = "TCP")]
TCP,
#[serde(rename = "UDP")]
UDP,
#[serde(rename = "SCTP")]
SCTP,
#[serde(rename = "ANY")]
ANY,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemToPortsItemPortsItem {
/// EndPort can only be an L4 port number.
#[serde(default)]
pub end_port: Option<i64>,
/// Port can be an L4 port number, or a name in the form of "http" or "http-8080".
pub port: String,
/// Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", "SCTP", "ANY"
/// Matching on ICMP is not supported.
/// Named port specified for a container may narrow this down, but may not contradict this.
#[serde(default)]
pub protocol: Option<CiliumNetworkPolicyIngressDenyItemToPortsItemPortsItemProtocolKind>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItemToPortsItem {
/// Ports is a list of L4 port/protocol
#[serde(default)]
pub ports: Option<Vec<CiliumNetworkPolicyIngressDenyItemToPortsItemPortsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyIngressDenyItem {
/// FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. Only connections which do *not* originate from the cluster or from the local host are subject to CIDR rules. In order to allow in-cluster connectivity, use the FromEndpoints field. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
/// Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.3.9.1
#[serde(default)]
pub from_c_i_d_r: Option<Vec<String>>,
/// FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
/// Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
#[serde(default)]
pub from_c_i_d_r_set: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromCIDRSetItem>>,
/// FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.
/// Example: Any endpoint with the label "role=backend" can be consumed by any endpoint carrying the label "role=frontend".
#[serde(default)]
pub from_endpoints: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromEndpointsItem>>,
/// FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster` and `host`
#[serde(default)]
pub from_entities: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromEntitiesItemKind>>,
/// FromGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives:
/// Example: FromGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'
#[serde(default)]
pub from_groups: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromGroupsItem>>,
/// FromNodes is a list of nodes identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.
#[serde(default)]
pub from_nodes: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromNodesItem>>,
/// FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints.
/// Example: Any Endpoint with the label "team=A" requires consuming endpoint to also carry the label "team=A".
#[serde(default)]
pub from_requires: Option<Vec<CiliumNetworkPolicyIngressDenyItemFromRequiresItem>>,
/// ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is not allowed to receive connections on.
/// Example: Any endpoint with the label "app=httpd" can not accept incoming type 8 ICMP connections.
#[serde(default)]
pub icmps: Option<Vec<CiliumNetworkPolicyIngressDenyItemIcmpsItem>>,
/// ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is not allowed to receive connections on.
/// Example: Any endpoint with the label "app=httpd" can not accept incoming connections on port 80/tcp.
#[serde(default)]
pub to_ports: Option<Vec<CiliumNetworkPolicyIngressDenyItemToPortsItem>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyLabelsItem {
pub key: String,
/// Source can be one of the above values (e.g.: LabelSourceContainer).
#[serde(default)]
pub source: Option<String>,
#[serde(default)]
pub value: Option<String>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum CiliumNetworkPolicyNodeSelectorMatchExpressionsItemOperatorKind {
#[serde(rename = "In")]
In,
#[serde(rename = "NotIn")]
NotIn,
#[serde(rename = "Exists")]
Exists,
#[serde(rename = "DoesNotExist")]
DoesNotExist,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyNodeSelectorMatchExpressionsItem {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: CiliumNetworkPolicyNodeSelectorMatchExpressionsItemOperatorKind,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default)]
pub values: Option<Vec<String>>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CiliumNetworkPolicyNodeSelector {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default)]
pub match_expressions: Option<Vec<CiliumNetworkPolicyNodeSelectorMatchExpressionsItem>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default)]
pub match_labels: Option<std::collections::HashMap<String, String>>,
}
// ── Render metadata (consumed by tatara-render) ──────────
impl tatara_lisp::RenderableDomain for CiliumNetworkPolicySpec {
const API_VERSION: &'static str = "cilium.io/v2";
const KIND: &'static str = "CiliumNetworkPolicy";
const NAME_FIELD: &'static str = "name";
}
// ── Documentation metadata (consumed by tatara-doc / IDE) ──
impl tatara_lisp::DocumentedDomain for CiliumNetworkPolicySpec {
const DOCSTRING: &'static str = "CiliumNetworkPolicy is a Kubernetes third-party resource with an extended version of NetworkPolicy.";
const FIELD_DOCS: &'static [(&'static str, &'static str)] = &[
("description", "Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment."),
("egress", "Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress."),
("egress_deny", "EgressDeny is a list of EgressDenyRule which are enforced at egress. Any rule inserted here will be denied regardless of the allowed egress rules in the 'egress' field. If omitted or empty, this rule does not apply at egress."),
("enable_default_deny", "EnableDefaultDeny determines whether this policy configures the subject endpoint(s) to have a default deny mode. If enabled, this causes all traffic not explicitly allowed by a network policy to be dropped. If not specified, the default is true for each traffic direction that has rules, and false otherwise. For example, if a policy only has Ingress or IngressDeny rules, then the default for ingress is true and egress is false. If multiple policies apply to an endpoint, that endpoint's default deny will be enabled if any policy requests it. This is useful for creating broad-based network policies that will not cause endpoints to enter default-deny mode."),
("endpoint_selector", "EndpointSelector selects all endpoints which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive."),
("ingress", "Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress."),
("ingress_deny", "IngressDeny is a list of IngressDenyRule which are enforced at ingress. Any rule inserted here will be denied regardless of the allowed ingress rules in the 'ingress' field. If omitted or empty, this rule does not apply at ingress."),
("labels", "Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels."),
("node_selector", "NodeSelector selects all nodes which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive. Can only be used in CiliumClusterwideNetworkPolicies."),
];
}
// ── Default capabilities (Layers 3/4/7/8/9/10/11/12) ──
tatara_lisp::impl_default_capabilities!(CiliumNetworkPolicySpec);
// ── Attestation metadata (consumed by tameshi BLAKE3 chain) ──
impl tatara_lisp::AttestableDomain for CiliumNetworkPolicySpec {
const ATTESTATION_NAMESPACE: &'static str = "cilium.io";
}
// ── Schema metadata (consumed by IDEs / openapi exporters) ──
impl tatara_lisp::SchematicDomain for CiliumNetworkPolicySpec {
const SCHEMA_JSON: &'static str = "{\"description\":\"CiliumNetworkPolicy is a Kubernetes third-party resource with an extended version of NetworkPolicy.\",\"properties\":{\"apiVersion\":{\"description\":\"APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources\",\"type\":\"string\"},\"kind\":{\"description\":\"Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\",\"type\":\"string\"},\"metadata\":{\"type\":\"object\"},\"spec\":{\"description\":\"Spec is the desired Cilium specific rule specification.\",\"oneOf\":[{\"properties\":{\"endpointSelector\":{}},\"required\":[\"endpointSelector\"]},{\"properties\":{\"nodeSelector\":{}},\"required\":[\"nodeSelector\"]}],\"properties\":{\"description\":{\"description\":\"Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment.\",\"type\":\"string\"},\"egress\":{\"description\":\"Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress.\",\"items\":{\"description\":\"EgressRule contains all rule types which can be applied at egress, i.e. network traffic that originates inside the endpoint and exits the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members of the structure are specified, then all members must match in order for the rule to take effect. The exception to this rule is the ToRequires member; the effects of any Requires field in any rule will apply to all other rules as well. \\n - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"authentication\":{\"description\":\"Authentication is the required authentication type for the allowed traffic, if any.\",\"properties\":{\"mode\":{\"description\":\"Mode is the required authentication mode for the allowed traffic, if any.\",\"enum\":[\"disabled\",\"required\",\"test-always-fail\"],\"type\":\"string\"}},\"required\":[\"mode\"],\"type\":\"object\"},\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to connect to. \\n Example: Any endpoint with the label \\\"app=httpd\\\" is allowed to initiate type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toCIDR\":{\"description\":\"ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"toCIDRSet\":{\"description\":\"ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEndpoints\":{\"description\":\"ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate. \\n Example: Any endpoint with the label \\\"role=frontend\\\" can communicate with any endpoint carrying the label \\\"role=backend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEntities\":{\"description\":\"ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`,`host`,`remote-node`,`kube-apiserver`, `init`, `health`,`unmanaged` and `all`.\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"toFQDNs\":{\"description\":\"ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result from DNS resolution of `ToFQDN.MatchName`s are added to the same EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and L7 rules within this EgressRule will also apply to these IPs. The DNS -> IP mapping is re-resolved periodically from within the cilium-agent, and the IPs in the DNS response are effected in the policy for selected pods as-is (i.e. the list of IPs is not modified in any way). Note: An explicit rule to allow for DNS traffic is needed for the pods, as ToFQDN counts as an egress rule and will enforce egress policy when PolicyEnforcment=default. Note: If the resolved IPs are IPs within the kubernetes cluster, the ToFQDN rule will not apply to that IP. Note: ToFQDN cannot occur in the same policy as other To* rules.\",\"items\":{\"oneOf\":[{\"properties\":{\"matchName\":{}},\"required\":[\"matchName\"]},{\"properties\":{\"matchPattern\":{}},\"required\":[\"matchPattern\"]}],\"properties\":{\"matchName\":{\"description\":\"MatchName matches literal DNS names. A trailing \\\".\\\" is automatically added when missing.\",\"pattern\":\"^([-a-zA-Z0-9_]+[.]?)+$\",\"type\":\"string\"},\"matchPattern\":{\"description\":\"MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - \\\"*\\\" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a \\\"*\\\" as the leftmost character, without a following \\\".\\\" matches all subdomains as well as the name to the right. A trailing \\\".\\\" is automatically added when missing. \\n Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with \\\"cilium.io\\\" except those containing \\\".\\\" separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with \\\"sub\\\" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not\",\"pattern\":\"^([-a-zA-Z0-9_*]+[.]?)+$\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"toGroups\":{\"description\":\"ToGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toNodes\":{\"description\":\"ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to. \\n Example: Any endpoint with the label \\\"role=frontend\\\" is allowed to initiate connections to destination port 8080/tcp\",\"items\":{\"description\":\"PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.\",\"properties\":{\"listener\":{\"description\":\"listener specifies the name of a custom Envoy listener to which this traffic should be redirected to.\",\"properties\":{\"envoyConfig\":{\"description\":\"EnvoyConfig is a reference to the CEC or CCEC resource in which the listener is defined.\",\"properties\":{\"kind\":{\"description\":\"Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, respectively. The only case this is currently explicitly needed is when referring to a CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener from a cluster scoped policy is not allowed.\",\"enum\":[\"CiliumEnvoyConfig\",\"CiliumClusterwideEnvoyConfig\"],\"type\":\"string\"},\"name\":{\"description\":\"Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where the listener is defined in.\",\"minLength\":1,\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"name\":{\"description\":\"Name is the name of the listener.\",\"minLength\":1,\"type\":\"string\"},\"priority\":{\"description\":\"Priority for this Listener that is used when multiple rules would apply different listeners to a policy map entry. Behavior of this is implementation dependent.\",\"maximum\":100,\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"envoyConfig\",\"name\"],\"type\":\"object\"},\"originatingTLS\":{\"description\":\"OriginatingTLS is the TLS context for the connections originated by the L7 proxy. For egress policy this specifies the client-side TLS parameters for the upstream connection originating from the L7 proxy to the remote destination. For ingress policy this specifies the client-side TLS parameters for the connection from the L7 proxy to the local endpoint.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"},\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"},\"rules\":{\"description\":\"Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.\",\"oneOf\":[{\"properties\":{\"http\":{}},\"required\":[\"http\"]},{\"properties\":{\"kafka\":{}},\"required\":[\"kafka\"]},{\"properties\":{\"dns\":{}},\"required\":[\"dns\"]},{\"properties\":{\"l7proto\":{}},\"required\":[\"l7proto\"]}],\"properties\":{\"dns\":{\"description\":\"DNS-specific rules.\",\"items\":{\"description\":\"PortRuleDNS is a list of allowed DNS lookups.\",\"oneOf\":[{\"properties\":{\"matchName\":{}},\"required\":[\"matchName\"]},{\"properties\":{\"matchPattern\":{}},\"required\":[\"matchPattern\"]}],\"properties\":{\"matchName\":{\"description\":\"MatchName matches literal DNS names. A trailing \\\".\\\" is automatically added when missing.\",\"pattern\":\"^([-a-zA-Z0-9_]+[.]?)+$\",\"type\":\"string\"},\"matchPattern\":{\"description\":\"MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - \\\"*\\\" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a \\\"*\\\" as the leftmost character, without a following \\\".\\\" matches all subdomains as well as the name to the right. A trailing \\\".\\\" is automatically added when missing. \\n Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with \\\"cilium.io\\\" except those containing \\\".\\\" separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with \\\"sub\\\" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not\",\"pattern\":\"^([-a-zA-Z0-9_*]+[.]?)+$\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"http\":{\"description\":\"HTTP specific rules.\",\"items\":{\"description\":\"PortRuleHTTP is a list of HTTP protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect. \\n All fields of this type are extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986.\",\"properties\":{\"headerMatches\":{\"description\":\"HeaderMatches is a list of HTTP headers which must be present and match against the given values. Mismatch field can be used to specify what to do when there is no match.\",\"items\":{\"description\":\"HeaderMatch extends the HeaderValue for matching requirement of a named header field against an immediate string, a secret value, or a regex. If none of the optional fields is present, then the header value is not matched, only presence of the header is enough.\",\"properties\":{\"mismatch\":{\"description\":\"Mismatch identifies what to do in case there is no match. The default is to drop the request. Otherwise the overall rule is still considered as matching, but the mismatches are logged in the access log.\",\"enum\":[\"LOG\",\"ADD\",\"DELETE\",\"REPLACE\"],\"type\":\"string\"},\"name\":{\"description\":\"Name identifies the header.\",\"minLength\":1,\"type\":\"string\"},\"secret\":{\"description\":\"Secret refers to a secret that contains the value to be matched against. The secret must only contain one entry. If the referred secret does not exist, and there is no \\\"Value\\\" specified, the match will fail.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"value\":{\"description\":\"Value matches the exact value of the header. Can be specified either alone or together with \\\"Secret\\\"; will be used as the header value if the secret can not be found in the latter case.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"type\":\"array\"},\"headers\":{\"description\":\"Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"host\":{\"description\":\"Host is an extended POSIX regex matched against the host header of a request. Examples: \\n - foo.bar.com will match the host fooXbar.com or foo-bar.com - foo\\\\.bar\\\\.com will only match the host foo.bar.com \\n If omitted or empty, the value of the host header is ignored.\",\"format\":\"idn-hostname\",\"type\":\"string\"},\"method\":{\"description\":\"Method is an extended POSIX regex matched against the method of a request, e.g. \\\"GET\\\", \\\"POST\\\", \\\"PUT\\\", \\\"PATCH\\\", \\\"DELETE\\\", ... \\n If omitted or empty, all methods are allowed.\",\"type\":\"string\"},\"path\":{\"description\":\"Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986. \\n If omitted or empty, all paths are all allowed.\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"kafka\":{\"description\":\"Kafka-specific rules.\",\"items\":{\"description\":\"PortRule is a list of Kafka protocol constraints. All fields are optional, if all fields are empty or missing, the rule will match all Kafka messages.\",\"properties\":{\"apiKey\":{\"description\":\"APIKey is a case-insensitive string matched against the key of a request, e.g. \\\"produce\\\", \\\"fetch\\\", \\\"createtopic\\\", \\\"deletetopic\\\", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys \\n If omitted or empty, and if Role is not specified, then all keys are allowed.\",\"type\":\"string\"},\"apiVersion\":{\"description\":\"APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. \\n If omitted or empty, all versions are allowed.\",\"type\":\"string\"},\"clientID\":{\"description\":\"ClientID is the client identifier as provided in the request. \\n From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. \\n If omitted or empty, all client identifiers are allowed.\",\"type\":\"string\"},\"role\":{\"description\":\"Role is a case-insensitive string and describes a group of API keys necessary to perform certain higher-level Kafka operations such as \\\"produce\\\" or \\\"consume\\\". A Role automatically expands into all APIKeys required to perform the specified higher-level operation. \\n The following values are supported: - \\\"produce\\\": Allow producing to the topics specified in the rule - \\\"consume\\\": Allow consuming from the topics specified in the rule \\n This field is incompatible with the APIKey field, i.e APIKey and Role cannot both be specified in the same rule. \\n If omitted or empty, and if APIKey is not specified, then all keys are allowed.\",\"enum\":[\"produce\",\"consume\"],\"type\":\"string\"},\"topic\":{\"description\":\"Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. \\n This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _. \\n Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255. \\n If omitted or empty, all topics are allowed.\",\"maxLength\":255,\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"l7\":{\"description\":\"Key-value pair rules.\",\"items\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"PortRuleL7 is a list of key-value pairs interpreted by a L7 protocol as protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect.\",\"type\":\"object\"},\"type\":\"array\"},\"l7proto\":{\"description\":\"Name of the L7 protocol for which the Key-value pair rules apply.\",\"type\":\"string\"}},\"type\":\"object\"},\"serverNames\":{\"description\":\"ServerNames is a list of allowed TLS SNI values. If not empty, then TLS must be present and one of the provided SNIs must be indicated in the TLS handshake.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"terminatingTLS\":{\"description\":\"TerminatingTLS is the TLS context for the connection terminated by the L7 proxy. For egress policy this specifies the server-side TLS parameters to be applied on the connections originated from the local endpoint and terminated by the L7 proxy. For ingress policy this specifies the server-side TLS parameters to be applied on the connections originated from a remote source and terminated by the L7 proxy.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toRequires\":{\"description\":\"ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to connect to other endpoints. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching ToEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires any endpoint to which it communicates to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toServices\":{\"description\":\"ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services without selectors. \\n Example: Any endpoint with the label \\\"app=backend-app\\\" is allowed to initiate connections to all cidrs backing the \\\"external-service\\\" service\",\"items\":{\"description\":\"Service wraps around selectors for services\",\"properties\":{\"k8sService\":{\"description\":\"K8sService selects service by name and namespace pair\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"serviceName\":{\"type\":\"string\"}},\"type\":\"object\"},\"k8sServiceSelector\":{\"description\":\"K8sServiceSelector selects services by k8s labels and namespace\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"selector\":{\"description\":\"ServiceSelector is a label selector for k8s services\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"selector\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"egressDeny\":{\"description\":\"EgressDeny is a list of EgressDenyRule which are enforced at egress. Any rule inserted here will be denied regardless of the allowed egress rules in the 'egress' field. If omitted or empty, this rule does not apply at egress.\",\"items\":{\"description\":\"EgressDenyRule contains all rule types which can be applied at egress, i.e. network traffic that originates inside the endpoint and exits the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members of the structure are specified, then all members must match in order for the rule to take effect. The exception to this rule is the ToRequires member; the effects of any Requires field in any rule will apply to all other rules as well. \\n - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is not allowed to connect to. \\n Example: Any endpoint with the label \\\"app=httpd\\\" is not allowed to initiate type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toCIDR\":{\"description\":\"ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"toCIDRSet\":{\"description\":\"ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEndpoints\":{\"description\":\"ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate. \\n Example: Any endpoint with the label \\\"role=frontend\\\" can communicate with any endpoint carrying the label \\\"role=backend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEntities\":{\"description\":\"ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`,`host`,`remote-node`,`kube-apiserver`, `init`, `health`,`unmanaged` and `all`.\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"toGroups\":{\"description\":\"ToGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toNodes\":{\"description\":\"ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is not allowed to connect to. \\n Example: Any endpoint with the label \\\"role=frontend\\\" is not allowed to initiate connections to destination port 8080/tcp\",\"items\":{\"description\":\"PortDenyRule is a list of ports/protocol that should be used for deny policies. This structure lacks the L7Rules since it's not supported in deny policies.\",\"properties\":{\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toRequires\":{\"description\":\"ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to connect to other endpoints. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching ToEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires any endpoint to which it communicates to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toServices\":{\"description\":\"ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services without selectors. \\n Example: Any endpoint with the label \\\"app=backend-app\\\" is allowed to initiate connections to all cidrs backing the \\\"external-service\\\" service\",\"items\":{\"description\":\"Service wraps around selectors for services\",\"properties\":{\"k8sService\":{\"description\":\"K8sService selects service by name and namespace pair\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"serviceName\":{\"type\":\"string\"}},\"type\":\"object\"},\"k8sServiceSelector\":{\"description\":\"K8sServiceSelector selects services by k8s labels and namespace\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"selector\":{\"description\":\"ServiceSelector is a label selector for k8s services\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"selector\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"enableDefaultDeny\":{\"description\":\"EnableDefaultDeny determines whether this policy configures the subject endpoint(s) to have a default deny mode. If enabled, this causes all traffic not explicitly allowed by a network policy to be dropped. \\n If not specified, the default is true for each traffic direction that has rules, and false otherwise. For example, if a policy only has Ingress or IngressDeny rules, then the default for ingress is true and egress is false. \\n If multiple policies apply to an endpoint, that endpoint's default deny will be enabled if any policy requests it. \\n This is useful for creating broad-based network policies that will not cause endpoints to enter default-deny mode.\",\"properties\":{\"egress\":{\"description\":\"Whether or not the endpoint should have a default-deny rule applied to egress traffic.\",\"type\":\"boolean\"},\"ingress\":{\"description\":\"Whether or not the endpoint should have a default-deny rule applied to ingress traffic.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"endpointSelector\":{\"description\":\"EndpointSelector selects all endpoints which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"ingress\":{\"description\":\"Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress.\",\"items\":{\"description\":\"IngressRule contains all rule types which can be applied at ingress, i.e. network traffic that originates outside of the endpoint and is entering the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members are set, all of them need to match in order for the rule to take effect. The exception to this rule is FromRequires field; the effects of any Requires field in any rule will apply to all other rules as well. \\n - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"authentication\":{\"description\":\"Authentication is the required authentication type for the allowed traffic, if any.\",\"properties\":{\"mode\":{\"description\":\"Mode is the required authentication mode for the allowed traffic, if any.\",\"enum\":[\"disabled\",\"required\",\"test-always-fail\"],\"type\":\"string\"}},\"required\":[\"mode\"],\"type\":\"object\"},\"fromCIDR\":{\"description\":\"FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. Only connections which do *not* originate from the cluster or from the local host are subject to CIDR rules. In order to allow in-cluster connectivity, use the FromEndpoints field. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.3.9.1\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"fromCIDRSet\":{\"description\":\"FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEndpoints\":{\"description\":\"FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. \\n Example: Any endpoint with the label \\\"role=backend\\\" can be consumed by any endpoint carrying the label \\\"role=frontend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEntities\":{\"description\":\"FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster` and `host`\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"fromGroups\":{\"description\":\"FromGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: FromGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromNodes\":{\"description\":\"FromNodes is a list of nodes identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromRequires\":{\"description\":\"FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires consuming endpoint to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can only accept incoming type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can only accept incoming connections on port 80/tcp.\",\"items\":{\"description\":\"PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.\",\"properties\":{\"listener\":{\"description\":\"listener specifies the name of a custom Envoy listener to which this traffic should be redirected to.\",\"properties\":{\"envoyConfig\":{\"description\":\"EnvoyConfig is a reference to the CEC or CCEC resource in which the listener is defined.\",\"properties\":{\"kind\":{\"description\":\"Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, respectively. The only case this is currently explicitly needed is when referring to a CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener from a cluster scoped policy is not allowed.\",\"enum\":[\"CiliumEnvoyConfig\",\"CiliumClusterwideEnvoyConfig\"],\"type\":\"string\"},\"name\":{\"description\":\"Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where the listener is defined in.\",\"minLength\":1,\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"name\":{\"description\":\"Name is the name of the listener.\",\"minLength\":1,\"type\":\"string\"},\"priority\":{\"description\":\"Priority for this Listener that is used when multiple rules would apply different listeners to a policy map entry. Behavior of this is implementation dependent.\",\"maximum\":100,\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"envoyConfig\",\"name\"],\"type\":\"object\"},\"originatingTLS\":{\"description\":\"OriginatingTLS is the TLS context for the connections originated by the L7 proxy. For egress policy this specifies the client-side TLS parameters for the upstream connection originating from the L7 proxy to the remote destination. For ingress policy this specifies the client-side TLS parameters for the connection from the L7 proxy to the local endpoint.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"},\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"},\"rules\":{\"description\":\"Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.\",\"oneOf\":[{\"properties\":{\"http\":{}},\"required\":[\"http\"]},{\"properties\":{\"kafka\":{}},\"required\":[\"kafka\"]},{\"properties\":{\"dns\":{}},\"required\":[\"dns\"]},{\"properties\":{\"l7proto\":{}},\"required\":[\"l7proto\"]}],\"properties\":{\"dns\":{\"description\":\"DNS-specific rules.\",\"items\":{\"description\":\"PortRuleDNS is a list of allowed DNS lookups.\",\"oneOf\":[{\"properties\":{\"matchName\":{}},\"required\":[\"matchName\"]},{\"properties\":{\"matchPattern\":{}},\"required\":[\"matchPattern\"]}],\"properties\":{\"matchName\":{\"description\":\"MatchName matches literal DNS names. A trailing \\\".\\\" is automatically added when missing.\",\"pattern\":\"^([-a-zA-Z0-9_]+[.]?)+$\",\"type\":\"string\"},\"matchPattern\":{\"description\":\"MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - \\\"*\\\" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a \\\"*\\\" as the leftmost character, without a following \\\".\\\" matches all subdomains as well as the name to the right. A trailing \\\".\\\" is automatically added when missing. \\n Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with \\\"cilium.io\\\" except those containing \\\".\\\" separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with \\\"sub\\\" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not\",\"pattern\":\"^([-a-zA-Z0-9_*]+[.]?)+$\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"http\":{\"description\":\"HTTP specific rules.\",\"items\":{\"description\":\"PortRuleHTTP is a list of HTTP protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect. \\n All fields of this type are extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986.\",\"properties\":{\"headerMatches\":{\"description\":\"HeaderMatches is a list of HTTP headers which must be present and match against the given values. Mismatch field can be used to specify what to do when there is no match.\",\"items\":{\"description\":\"HeaderMatch extends the HeaderValue for matching requirement of a named header field against an immediate string, a secret value, or a regex. If none of the optional fields is present, then the header value is not matched, only presence of the header is enough.\",\"properties\":{\"mismatch\":{\"description\":\"Mismatch identifies what to do in case there is no match. The default is to drop the request. Otherwise the overall rule is still considered as matching, but the mismatches are logged in the access log.\",\"enum\":[\"LOG\",\"ADD\",\"DELETE\",\"REPLACE\"],\"type\":\"string\"},\"name\":{\"description\":\"Name identifies the header.\",\"minLength\":1,\"type\":\"string\"},\"secret\":{\"description\":\"Secret refers to a secret that contains the value to be matched against. The secret must only contain one entry. If the referred secret does not exist, and there is no \\\"Value\\\" specified, the match will fail.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"value\":{\"description\":\"Value matches the exact value of the header. Can be specified either alone or together with \\\"Secret\\\"; will be used as the header value if the secret can not be found in the latter case.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"type\":\"array\"},\"headers\":{\"description\":\"Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"host\":{\"description\":\"Host is an extended POSIX regex matched against the host header of a request. Examples: \\n - foo.bar.com will match the host fooXbar.com or foo-bar.com - foo\\\\.bar\\\\.com will only match the host foo.bar.com \\n If omitted or empty, the value of the host header is ignored.\",\"format\":\"idn-hostname\",\"type\":\"string\"},\"method\":{\"description\":\"Method is an extended POSIX regex matched against the method of a request, e.g. \\\"GET\\\", \\\"POST\\\", \\\"PUT\\\", \\\"PATCH\\\", \\\"DELETE\\\", ... \\n If omitted or empty, all methods are allowed.\",\"type\":\"string\"},\"path\":{\"description\":\"Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986. \\n If omitted or empty, all paths are all allowed.\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"kafka\":{\"description\":\"Kafka-specific rules.\",\"items\":{\"description\":\"PortRule is a list of Kafka protocol constraints. All fields are optional, if all fields are empty or missing, the rule will match all Kafka messages.\",\"properties\":{\"apiKey\":{\"description\":\"APIKey is a case-insensitive string matched against the key of a request, e.g. \\\"produce\\\", \\\"fetch\\\", \\\"createtopic\\\", \\\"deletetopic\\\", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys \\n If omitted or empty, and if Role is not specified, then all keys are allowed.\",\"type\":\"string\"},\"apiVersion\":{\"description\":\"APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. \\n If omitted or empty, all versions are allowed.\",\"type\":\"string\"},\"clientID\":{\"description\":\"ClientID is the client identifier as provided in the request. \\n From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. \\n If omitted or empty, all client identifiers are allowed.\",\"type\":\"string\"},\"role\":{\"description\":\"Role is a case-insensitive string and describes a group of API keys necessary to perform certain higher-level Kafka operations such as \\\"produce\\\" or \\\"consume\\\". A Role automatically expands into all APIKeys required to perform the specified higher-level operation. \\n The following values are supported: - \\\"produce\\\": Allow producing to the topics specified in the rule - \\\"consume\\\": Allow consuming from the topics specified in the rule \\n This field is incompatible with the APIKey field, i.e APIKey and Role cannot both be specified in the same rule. \\n If omitted or empty, and if APIKey is not specified, then all keys are allowed.\",\"enum\":[\"produce\",\"consume\"],\"type\":\"string\"},\"topic\":{\"description\":\"Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. \\n This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _. \\n Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255. \\n If omitted or empty, all topics are allowed.\",\"maxLength\":255,\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"l7\":{\"description\":\"Key-value pair rules.\",\"items\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"PortRuleL7 is a list of key-value pairs interpreted by a L7 protocol as protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect.\",\"type\":\"object\"},\"type\":\"array\"},\"l7proto\":{\"description\":\"Name of the L7 protocol for which the Key-value pair rules apply.\",\"type\":\"string\"}},\"type\":\"object\"},\"serverNames\":{\"description\":\"ServerNames is a list of allowed TLS SNI values. If not empty, then TLS must be present and one of the provided SNIs must be indicated in the TLS handshake.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"terminatingTLS\":{\"description\":\"TerminatingTLS is the TLS context for the connection terminated by the L7 proxy. For egress policy this specifies the server-side TLS parameters to be applied on the connections originated from the local endpoint and terminated by the L7 proxy. For ingress policy this specifies the server-side TLS parameters to be applied on the connections originated from a remote source and terminated by the L7 proxy.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"ingressDeny\":{\"description\":\"IngressDeny is a list of IngressDenyRule which are enforced at ingress. Any rule inserted here will be denied regardless of the allowed ingress rules in the 'ingress' field. If omitted or empty, this rule does not apply at ingress.\",\"items\":{\"description\":\"IngressDenyRule contains all rule types which can be applied at ingress, i.e. network traffic that originates outside of the endpoint and is entering the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members are set, all of them need to match in order for the rule to take effect. The exception to this rule is FromRequires field; the effects of any Requires field in any rule will apply to all other rules as well. \\n - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"fromCIDR\":{\"description\":\"FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. Only connections which do *not* originate from the cluster or from the local host are subject to CIDR rules. In order to allow in-cluster connectivity, use the FromEndpoints field. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.3.9.1\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"fromCIDRSet\":{\"description\":\"FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEndpoints\":{\"description\":\"FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. \\n Example: Any endpoint with the label \\\"role=backend\\\" can be consumed by any endpoint carrying the label \\\"role=frontend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEntities\":{\"description\":\"FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster` and `host`\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"fromGroups\":{\"description\":\"FromGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: FromGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromNodes\":{\"description\":\"FromNodes is a list of nodes identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromRequires\":{\"description\":\"FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires consuming endpoint to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is not allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can not accept incoming type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is not allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can not accept incoming connections on port 80/tcp.\",\"items\":{\"description\":\"PortDenyRule is a list of ports/protocol that should be used for deny policies. This structure lacks the L7Rules since it's not supported in deny policies.\",\"properties\":{\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"labels\":{\"description\":\"Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels.\",\"items\":{\"description\":\"Label is the Cilium's representation of a container label.\",\"properties\":{\"key\":{\"type\":\"string\"},\"source\":{\"description\":\"Source can be one of the above values (e.g.: LabelSourceContainer).\",\"type\":\"string\"},\"value\":{\"type\":\"string\"}},\"required\":[\"key\"],\"type\":\"object\"},\"type\":\"array\"},\"nodeSelector\":{\"description\":\"NodeSelector selects all nodes which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive. Can only be used in CiliumClusterwideNetworkPolicies.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"}},\"type\":\"object\"},\"specs\":{\"description\":\"Specs is a list of desired Cilium specific rule specification.\",\"items\":{\"description\":\"Rule is a policy rule which must be applied to all endpoints which match the labels contained in the endpointSelector \\n Each rule is split into an ingress section which contains all rules applicable at ingress, and an egress section applicable at egress. For rule types such as `L4Rule` and `CIDR` which can be applied at both ingress and egress, both ingress and egress side have to either specifically allow the connection or one side has to be omitted. \\n Either ingress, egress, or both can be provided. If both ingress and egress are omitted, the rule has no effect.\",\"oneOf\":[{\"properties\":{\"endpointSelector\":{}},\"required\":[\"endpointSelector\"]},{\"properties\":{\"nodeSelector\":{}},\"required\":[\"nodeSelector\"]}],\"properties\":{\"description\":{\"description\":\"Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment.\",\"type\":\"string\"},\"egress\":{\"description\":\"Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress.\",\"items\":{\"description\":\"EgressRule contains all rule types which can be applied at egress, i.e. network traffic that originates inside the endpoint and exits the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members of the structure are specified, then all members must match in order for the rule to take effect. The exception to this rule is the ToRequires member; the effects of any Requires field in any rule will apply to all other rules as well. \\n - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"authentication\":{\"description\":\"Authentication is the required authentication type for the allowed traffic, if any.\",\"properties\":{\"mode\":{\"description\":\"Mode is the required authentication mode for the allowed traffic, if any.\",\"enum\":[\"disabled\",\"required\",\"test-always-fail\"],\"type\":\"string\"}},\"required\":[\"mode\"],\"type\":\"object\"},\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to connect to. \\n Example: Any endpoint with the label \\\"app=httpd\\\" is allowed to initiate type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toCIDR\":{\"description\":\"ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"toCIDRSet\":{\"description\":\"ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEndpoints\":{\"description\":\"ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate. \\n Example: Any endpoint with the label \\\"role=frontend\\\" can communicate with any endpoint carrying the label \\\"role=backend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEntities\":{\"description\":\"ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`,`host`,`remote-node`,`kube-apiserver`, `init`, `health`,`unmanaged` and `all`.\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"toFQDNs\":{\"description\":\"ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result from DNS resolution of `ToFQDN.MatchName`s are added to the same EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and L7 rules within this EgressRule will also apply to these IPs. The DNS -> IP mapping is re-resolved periodically from within the cilium-agent, and the IPs in the DNS response are effected in the policy for selected pods as-is (i.e. the list of IPs is not modified in any way). Note: An explicit rule to allow for DNS traffic is needed for the pods, as ToFQDN counts as an egress rule and will enforce egress policy when PolicyEnforcment=default. Note: If the resolved IPs are IPs within the kubernetes cluster, the ToFQDN rule will not apply to that IP. Note: ToFQDN cannot occur in the same policy as other To* rules.\",\"items\":{\"oneOf\":[{\"properties\":{\"matchName\":{}},\"required\":[\"matchName\"]},{\"properties\":{\"matchPattern\":{}},\"required\":[\"matchPattern\"]}],\"properties\":{\"matchName\":{\"description\":\"MatchName matches literal DNS names. A trailing \\\".\\\" is automatically added when missing.\",\"pattern\":\"^([-a-zA-Z0-9_]+[.]?)+$\",\"type\":\"string\"},\"matchPattern\":{\"description\":\"MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - \\\"*\\\" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a \\\"*\\\" as the leftmost character, without a following \\\".\\\" matches all subdomains as well as the name to the right. A trailing \\\".\\\" is automatically added when missing. \\n Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with \\\"cilium.io\\\" except those containing \\\".\\\" separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with \\\"sub\\\" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not\",\"pattern\":\"^([-a-zA-Z0-9_*]+[.]?)+$\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"toGroups\":{\"description\":\"ToGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toNodes\":{\"description\":\"ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to. \\n Example: Any endpoint with the label \\\"role=frontend\\\" is allowed to initiate connections to destination port 8080/tcp\",\"items\":{\"description\":\"PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.\",\"properties\":{\"listener\":{\"description\":\"listener specifies the name of a custom Envoy listener to which this traffic should be redirected to.\",\"properties\":{\"envoyConfig\":{\"description\":\"EnvoyConfig is a reference to the CEC or CCEC resource in which the listener is defined.\",\"properties\":{\"kind\":{\"description\":\"Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, respectively. The only case this is currently explicitly needed is when referring to a CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener from a cluster scoped policy is not allowed.\",\"enum\":[\"CiliumEnvoyConfig\",\"CiliumClusterwideEnvoyConfig\"],\"type\":\"string\"},\"name\":{\"description\":\"Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where the listener is defined in.\",\"minLength\":1,\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"name\":{\"description\":\"Name is the name of the listener.\",\"minLength\":1,\"type\":\"string\"},\"priority\":{\"description\":\"Priority for this Listener that is used when multiple rules would apply different listeners to a policy map entry. Behavior of this is implementation dependent.\",\"maximum\":100,\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"envoyConfig\",\"name\"],\"type\":\"object\"},\"originatingTLS\":{\"description\":\"OriginatingTLS is the TLS context for the connections originated by the L7 proxy. For egress policy this specifies the client-side TLS parameters for the upstream connection originating from the L7 proxy to the remote destination. For ingress policy this specifies the client-side TLS parameters for the connection from the L7 proxy to the local endpoint.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"},\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"},\"rules\":{\"description\":\"Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.\",\"oneOf\":[{\"properties\":{\"http\":{}},\"required\":[\"http\"]},{\"properties\":{\"kafka\":{}},\"required\":[\"kafka\"]},{\"properties\":{\"dns\":{}},\"required\":[\"dns\"]},{\"properties\":{\"l7proto\":{}},\"required\":[\"l7proto\"]}],\"properties\":{\"dns\":{\"description\":\"DNS-specific rules.\",\"items\":{\"description\":\"PortRuleDNS is a list of allowed DNS lookups.\",\"oneOf\":[{\"properties\":{\"matchName\":{}},\"required\":[\"matchName\"]},{\"properties\":{\"matchPattern\":{}},\"required\":[\"matchPattern\"]}],\"properties\":{\"matchName\":{\"description\":\"MatchName matches literal DNS names. A trailing \\\".\\\" is automatically added when missing.\",\"pattern\":\"^([-a-zA-Z0-9_]+[.]?)+$\",\"type\":\"string\"},\"matchPattern\":{\"description\":\"MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - \\\"*\\\" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a \\\"*\\\" as the leftmost character, without a following \\\".\\\" matches all subdomains as well as the name to the right. A trailing \\\".\\\" is automatically added when missing. \\n Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with \\\"cilium.io\\\" except those containing \\\".\\\" separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with \\\"sub\\\" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not\",\"pattern\":\"^([-a-zA-Z0-9_*]+[.]?)+$\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"http\":{\"description\":\"HTTP specific rules.\",\"items\":{\"description\":\"PortRuleHTTP is a list of HTTP protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect. \\n All fields of this type are extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986.\",\"properties\":{\"headerMatches\":{\"description\":\"HeaderMatches is a list of HTTP headers which must be present and match against the given values. Mismatch field can be used to specify what to do when there is no match.\",\"items\":{\"description\":\"HeaderMatch extends the HeaderValue for matching requirement of a named header field against an immediate string, a secret value, or a regex. If none of the optional fields is present, then the header value is not matched, only presence of the header is enough.\",\"properties\":{\"mismatch\":{\"description\":\"Mismatch identifies what to do in case there is no match. The default is to drop the request. Otherwise the overall rule is still considered as matching, but the mismatches are logged in the access log.\",\"enum\":[\"LOG\",\"ADD\",\"DELETE\",\"REPLACE\"],\"type\":\"string\"},\"name\":{\"description\":\"Name identifies the header.\",\"minLength\":1,\"type\":\"string\"},\"secret\":{\"description\":\"Secret refers to a secret that contains the value to be matched against. The secret must only contain one entry. If the referred secret does not exist, and there is no \\\"Value\\\" specified, the match will fail.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"value\":{\"description\":\"Value matches the exact value of the header. Can be specified either alone or together with \\\"Secret\\\"; will be used as the header value if the secret can not be found in the latter case.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"type\":\"array\"},\"headers\":{\"description\":\"Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"host\":{\"description\":\"Host is an extended POSIX regex matched against the host header of a request. Examples: \\n - foo.bar.com will match the host fooXbar.com or foo-bar.com - foo\\\\.bar\\\\.com will only match the host foo.bar.com \\n If omitted or empty, the value of the host header is ignored.\",\"format\":\"idn-hostname\",\"type\":\"string\"},\"method\":{\"description\":\"Method is an extended POSIX regex matched against the method of a request, e.g. \\\"GET\\\", \\\"POST\\\", \\\"PUT\\\", \\\"PATCH\\\", \\\"DELETE\\\", ... \\n If omitted or empty, all methods are allowed.\",\"type\":\"string\"},\"path\":{\"description\":\"Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986. \\n If omitted or empty, all paths are all allowed.\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"kafka\":{\"description\":\"Kafka-specific rules.\",\"items\":{\"description\":\"PortRule is a list of Kafka protocol constraints. All fields are optional, if all fields are empty or missing, the rule will match all Kafka messages.\",\"properties\":{\"apiKey\":{\"description\":\"APIKey is a case-insensitive string matched against the key of a request, e.g. \\\"produce\\\", \\\"fetch\\\", \\\"createtopic\\\", \\\"deletetopic\\\", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys \\n If omitted or empty, and if Role is not specified, then all keys are allowed.\",\"type\":\"string\"},\"apiVersion\":{\"description\":\"APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. \\n If omitted or empty, all versions are allowed.\",\"type\":\"string\"},\"clientID\":{\"description\":\"ClientID is the client identifier as provided in the request. \\n From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. \\n If omitted or empty, all client identifiers are allowed.\",\"type\":\"string\"},\"role\":{\"description\":\"Role is a case-insensitive string and describes a group of API keys necessary to perform certain higher-level Kafka operations such as \\\"produce\\\" or \\\"consume\\\". A Role automatically expands into all APIKeys required to perform the specified higher-level operation. \\n The following values are supported: - \\\"produce\\\": Allow producing to the topics specified in the rule - \\\"consume\\\": Allow consuming from the topics specified in the rule \\n This field is incompatible with the APIKey field, i.e APIKey and Role cannot both be specified in the same rule. \\n If omitted or empty, and if APIKey is not specified, then all keys are allowed.\",\"enum\":[\"produce\",\"consume\"],\"type\":\"string\"},\"topic\":{\"description\":\"Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. \\n This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _. \\n Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255. \\n If omitted or empty, all topics are allowed.\",\"maxLength\":255,\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"l7\":{\"description\":\"Key-value pair rules.\",\"items\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"PortRuleL7 is a list of key-value pairs interpreted by a L7 protocol as protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect.\",\"type\":\"object\"},\"type\":\"array\"},\"l7proto\":{\"description\":\"Name of the L7 protocol for which the Key-value pair rules apply.\",\"type\":\"string\"}},\"type\":\"object\"},\"serverNames\":{\"description\":\"ServerNames is a list of allowed TLS SNI values. If not empty, then TLS must be present and one of the provided SNIs must be indicated in the TLS handshake.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"terminatingTLS\":{\"description\":\"TerminatingTLS is the TLS context for the connection terminated by the L7 proxy. For egress policy this specifies the server-side TLS parameters to be applied on the connections originated from the local endpoint and terminated by the L7 proxy. For ingress policy this specifies the server-side TLS parameters to be applied on the connections originated from a remote source and terminated by the L7 proxy.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toRequires\":{\"description\":\"ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to connect to other endpoints. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching ToEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires any endpoint to which it communicates to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toServices\":{\"description\":\"ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services without selectors. \\n Example: Any endpoint with the label \\\"app=backend-app\\\" is allowed to initiate connections to all cidrs backing the \\\"external-service\\\" service\",\"items\":{\"description\":\"Service wraps around selectors for services\",\"properties\":{\"k8sService\":{\"description\":\"K8sService selects service by name and namespace pair\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"serviceName\":{\"type\":\"string\"}},\"type\":\"object\"},\"k8sServiceSelector\":{\"description\":\"K8sServiceSelector selects services by k8s labels and namespace\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"selector\":{\"description\":\"ServiceSelector is a label selector for k8s services\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"selector\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"egressDeny\":{\"description\":\"EgressDeny is a list of EgressDenyRule which are enforced at egress. Any rule inserted here will be denied regardless of the allowed egress rules in the 'egress' field. If omitted or empty, this rule does not apply at egress.\",\"items\":{\"description\":\"EgressDenyRule contains all rule types which can be applied at egress, i.e. network traffic that originates inside the endpoint and exits the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members of the structure are specified, then all members must match in order for the rule to take effect. The exception to this rule is the ToRequires member; the effects of any Requires field in any rule will apply to all other rules as well. \\n - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is not allowed to connect to. \\n Example: Any endpoint with the label \\\"app=httpd\\\" is not allowed to initiate type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toCIDR\":{\"description\":\"ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"toCIDRSet\":{\"description\":\"ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. \\n Example: Any endpoint with the label \\\"app=database-proxy\\\" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEndpoints\":{\"description\":\"ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate. \\n Example: Any endpoint with the label \\\"role=frontend\\\" can communicate with any endpoint carrying the label \\\"role=backend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toEntities\":{\"description\":\"ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`,`host`,`remote-node`,`kube-apiserver`, `init`, `health`,`unmanaged` and `all`.\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"toGroups\":{\"description\":\"ToGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toNodes\":{\"description\":\"ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is not allowed to connect to. \\n Example: Any endpoint with the label \\\"role=frontend\\\" is not allowed to initiate connections to destination port 8080/tcp\",\"items\":{\"description\":\"PortDenyRule is a list of ports/protocol that should be used for deny policies. This structure lacks the L7Rules since it's not supported in deny policies.\",\"properties\":{\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toRequires\":{\"description\":\"ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to connect to other endpoints. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching ToEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires any endpoint to which it communicates to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"toServices\":{\"description\":\"ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services without selectors. \\n Example: Any endpoint with the label \\\"app=backend-app\\\" is allowed to initiate connections to all cidrs backing the \\\"external-service\\\" service\",\"items\":{\"description\":\"Service wraps around selectors for services\",\"properties\":{\"k8sService\":{\"description\":\"K8sService selects service by name and namespace pair\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"serviceName\":{\"type\":\"string\"}},\"type\":\"object\"},\"k8sServiceSelector\":{\"description\":\"K8sServiceSelector selects services by k8s labels and namespace\",\"properties\":{\"namespace\":{\"type\":\"string\"},\"selector\":{\"description\":\"ServiceSelector is a label selector for k8s services\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"selector\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"enableDefaultDeny\":{\"description\":\"EnableDefaultDeny determines whether this policy configures the subject endpoint(s) to have a default deny mode. If enabled, this causes all traffic not explicitly allowed by a network policy to be dropped. \\n If not specified, the default is true for each traffic direction that has rules, and false otherwise. For example, if a policy only has Ingress or IngressDeny rules, then the default for ingress is true and egress is false. \\n If multiple policies apply to an endpoint, that endpoint's default deny will be enabled if any policy requests it. \\n This is useful for creating broad-based network policies that will not cause endpoints to enter default-deny mode.\",\"properties\":{\"egress\":{\"description\":\"Whether or not the endpoint should have a default-deny rule applied to egress traffic.\",\"type\":\"boolean\"},\"ingress\":{\"description\":\"Whether or not the endpoint should have a default-deny rule applied to ingress traffic.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"endpointSelector\":{\"description\":\"EndpointSelector selects all endpoints which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"ingress\":{\"description\":\"Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress.\",\"items\":{\"description\":\"IngressRule contains all rule types which can be applied at ingress, i.e. network traffic that originates outside of the endpoint and is entering the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members are set, all of them need to match in order for the rule to take effect. The exception to this rule is FromRequires field; the effects of any Requires field in any rule will apply to all other rules as well. \\n - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"authentication\":{\"description\":\"Authentication is the required authentication type for the allowed traffic, if any.\",\"properties\":{\"mode\":{\"description\":\"Mode is the required authentication mode for the allowed traffic, if any.\",\"enum\":[\"disabled\",\"required\",\"test-always-fail\"],\"type\":\"string\"}},\"required\":[\"mode\"],\"type\":\"object\"},\"fromCIDR\":{\"description\":\"FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. Only connections which do *not* originate from the cluster or from the local host are subject to CIDR rules. In order to allow in-cluster connectivity, use the FromEndpoints field. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.3.9.1\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"fromCIDRSet\":{\"description\":\"FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEndpoints\":{\"description\":\"FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. \\n Example: Any endpoint with the label \\\"role=backend\\\" can be consumed by any endpoint carrying the label \\\"role=frontend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEntities\":{\"description\":\"FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster` and `host`\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"fromGroups\":{\"description\":\"FromGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: FromGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromNodes\":{\"description\":\"FromNodes is a list of nodes identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromRequires\":{\"description\":\"FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires consuming endpoint to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can only accept incoming type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can only accept incoming connections on port 80/tcp.\",\"items\":{\"description\":\"PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.\",\"properties\":{\"listener\":{\"description\":\"listener specifies the name of a custom Envoy listener to which this traffic should be redirected to.\",\"properties\":{\"envoyConfig\":{\"description\":\"EnvoyConfig is a reference to the CEC or CCEC resource in which the listener is defined.\",\"properties\":{\"kind\":{\"description\":\"Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, respectively. The only case this is currently explicitly needed is when referring to a CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener from a cluster scoped policy is not allowed.\",\"enum\":[\"CiliumEnvoyConfig\",\"CiliumClusterwideEnvoyConfig\"],\"type\":\"string\"},\"name\":{\"description\":\"Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where the listener is defined in.\",\"minLength\":1,\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"name\":{\"description\":\"Name is the name of the listener.\",\"minLength\":1,\"type\":\"string\"},\"priority\":{\"description\":\"Priority for this Listener that is used when multiple rules would apply different listeners to a policy map entry. Behavior of this is implementation dependent.\",\"maximum\":100,\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"envoyConfig\",\"name\"],\"type\":\"object\"},\"originatingTLS\":{\"description\":\"OriginatingTLS is the TLS context for the connections originated by the L7 proxy. For egress policy this specifies the client-side TLS parameters for the upstream connection originating from the L7 proxy to the remote destination. For ingress policy this specifies the client-side TLS parameters for the connection from the L7 proxy to the local endpoint.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"},\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"},\"rules\":{\"description\":\"Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.\",\"oneOf\":[{\"properties\":{\"http\":{}},\"required\":[\"http\"]},{\"properties\":{\"kafka\":{}},\"required\":[\"kafka\"]},{\"properties\":{\"dns\":{}},\"required\":[\"dns\"]},{\"properties\":{\"l7proto\":{}},\"required\":[\"l7proto\"]}],\"properties\":{\"dns\":{\"description\":\"DNS-specific rules.\",\"items\":{\"description\":\"PortRuleDNS is a list of allowed DNS lookups.\",\"oneOf\":[{\"properties\":{\"matchName\":{}},\"required\":[\"matchName\"]},{\"properties\":{\"matchPattern\":{}},\"required\":[\"matchPattern\"]}],\"properties\":{\"matchName\":{\"description\":\"MatchName matches literal DNS names. A trailing \\\".\\\" is automatically added when missing.\",\"pattern\":\"^([-a-zA-Z0-9_]+[.]?)+$\",\"type\":\"string\"},\"matchPattern\":{\"description\":\"MatchPattern allows using wildcards to match DNS names. All wildcards are case insensitive. The wildcards are: - \\\"*\\\" matches 0 or more DNS valid characters, and may occur anywhere in the pattern. As a special case a \\\"*\\\" as the leftmost character, without a following \\\".\\\" matches all subdomains as well as the name to the right. A trailing \\\".\\\" is automatically added when missing. \\n Examples: `*.cilium.io` matches subomains of cilium at that level www.cilium.io and blog.cilium.io match, cilium.io and google.com do not `*cilium.io` matches cilium.io and all subdomains ends with \\\"cilium.io\\\" except those containing \\\".\\\" separator, subcilium.io and sub-cilium.io match, www.cilium.io and blog.cilium.io does not sub*.cilium.io matches subdomains of cilium where the subdomain component begins with \\\"sub\\\" sub.cilium.io and subdomain.cilium.io match, www.cilium.io, blog.cilium.io, cilium.io and google.com do not\",\"pattern\":\"^([-a-zA-Z0-9_*]+[.]?)+$\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"http\":{\"description\":\"HTTP specific rules.\",\"items\":{\"description\":\"PortRuleHTTP is a list of HTTP protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect. \\n All fields of this type are extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986.\",\"properties\":{\"headerMatches\":{\"description\":\"HeaderMatches is a list of HTTP headers which must be present and match against the given values. Mismatch field can be used to specify what to do when there is no match.\",\"items\":{\"description\":\"HeaderMatch extends the HeaderValue for matching requirement of a named header field against an immediate string, a secret value, or a regex. If none of the optional fields is present, then the header value is not matched, only presence of the header is enough.\",\"properties\":{\"mismatch\":{\"description\":\"Mismatch identifies what to do in case there is no match. The default is to drop the request. Otherwise the overall rule is still considered as matching, but the mismatches are logged in the access log.\",\"enum\":[\"LOG\",\"ADD\",\"DELETE\",\"REPLACE\"],\"type\":\"string\"},\"name\":{\"description\":\"Name identifies the header.\",\"minLength\":1,\"type\":\"string\"},\"secret\":{\"description\":\"Secret refers to a secret that contains the value to be matched against. The secret must only contain one entry. If the referred secret does not exist, and there is no \\\"Value\\\" specified, the match will fail.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"value\":{\"description\":\"Value matches the exact value of the header. Can be specified either alone or together with \\\"Secret\\\"; will be used as the header value if the secret can not be found in the latter case.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"type\":\"array\"},\"headers\":{\"description\":\"Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"host\":{\"description\":\"Host is an extended POSIX regex matched against the host header of a request. Examples: \\n - foo.bar.com will match the host fooXbar.com or foo-bar.com - foo\\\\.bar\\\\.com will only match the host foo.bar.com \\n If omitted or empty, the value of the host header is ignored.\",\"format\":\"idn-hostname\",\"type\":\"string\"},\"method\":{\"description\":\"Method is an extended POSIX regex matched against the method of a request, e.g. \\\"GET\\\", \\\"POST\\\", \\\"PUT\\\", \\\"PATCH\\\", \\\"DELETE\\\", ... \\n If omitted or empty, all methods are allowed.\",\"type\":\"string\"},\"path\":{\"description\":\"Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional \\\"path\\\" part of a URL as defined by RFC 3986. \\n If omitted or empty, all paths are all allowed.\",\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"kafka\":{\"description\":\"Kafka-specific rules.\",\"items\":{\"description\":\"PortRule is a list of Kafka protocol constraints. All fields are optional, if all fields are empty or missing, the rule will match all Kafka messages.\",\"properties\":{\"apiKey\":{\"description\":\"APIKey is a case-insensitive string matched against the key of a request, e.g. \\\"produce\\\", \\\"fetch\\\", \\\"createtopic\\\", \\\"deletetopic\\\", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys \\n If omitted or empty, and if Role is not specified, then all keys are allowed.\",\"type\":\"string\"},\"apiVersion\":{\"description\":\"APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. \\n If omitted or empty, all versions are allowed.\",\"type\":\"string\"},\"clientID\":{\"description\":\"ClientID is the client identifier as provided in the request. \\n From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. \\n If omitted or empty, all client identifiers are allowed.\",\"type\":\"string\"},\"role\":{\"description\":\"Role is a case-insensitive string and describes a group of API keys necessary to perform certain higher-level Kafka operations such as \\\"produce\\\" or \\\"consume\\\". A Role automatically expands into all APIKeys required to perform the specified higher-level operation. \\n The following values are supported: - \\\"produce\\\": Allow producing to the topics specified in the rule - \\\"consume\\\": Allow consuming from the topics specified in the rule \\n This field is incompatible with the APIKey field, i.e APIKey and Role cannot both be specified in the same rule. \\n If omitted or empty, and if APIKey is not specified, then all keys are allowed.\",\"enum\":[\"produce\",\"consume\"],\"type\":\"string\"},\"topic\":{\"description\":\"Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. \\n This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _. \\n Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255. \\n If omitted or empty, all topics are allowed.\",\"maxLength\":255,\"type\":\"string\"}},\"type\":\"object\"},\"type\":\"array\"},\"l7\":{\"description\":\"Key-value pair rules.\",\"items\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"PortRuleL7 is a list of key-value pairs interpreted by a L7 protocol as protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect.\",\"type\":\"object\"},\"type\":\"array\"},\"l7proto\":{\"description\":\"Name of the L7 protocol for which the Key-value pair rules apply.\",\"type\":\"string\"}},\"type\":\"object\"},\"serverNames\":{\"description\":\"ServerNames is a list of allowed TLS SNI values. If not empty, then TLS must be present and one of the provided SNIs must be indicated in the TLS handshake.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"terminatingTLS\":{\"description\":\"TerminatingTLS is the TLS context for the connection terminated by the L7 proxy. For egress policy this specifies the server-side TLS parameters to be applied on the connections originated from the local endpoint and terminated by the L7 proxy. For ingress policy this specifies the server-side TLS parameters to be applied on the connections originated from a remote source and terminated by the L7 proxy.\",\"properties\":{\"certificate\":{\"description\":\"Certificate is the file name or k8s secret item name for the certificate chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"privateKey\":{\"description\":\"PrivateKey is the file name or k8s secret item name for the private key matching the certificate chain. If omitted, 'tls.key' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"},\"secret\":{\"description\":\"Secret is the secret that contains the certificates and private key for the TLS context. By default, Cilium will search in this secret for the following items: - 'ca.crt' - Which represents the trusted CA to verify remote source. - 'tls.crt' - Which represents the public key certificate. - 'tls.key' - Which represents the private key matching the public key certificate.\",\"properties\":{\"name\":{\"description\":\"Name is the name of the secret.\",\"type\":\"string\"},\"namespace\":{\"description\":\"Namespace is the namespace in which the secret exists. Context of use determines the default value if left out (e.g., \\\"default\\\").\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"trustedCA\":{\"description\":\"TrustedCA is the file name or k8s secret item name for the trusted CA. If omitted, 'ca.crt' is assumed, if it exists. If given, the item must exist.\",\"type\":\"string\"}},\"required\":[\"secret\"],\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"ingressDeny\":{\"description\":\"IngressDeny is a list of IngressDenyRule which are enforced at ingress. Any rule inserted here will be denied regardless of the allowed ingress rules in the 'ingress' field. If omitted or empty, this rule does not apply at ingress.\",\"items\":{\"description\":\"IngressDenyRule contains all rule types which can be applied at ingress, i.e. network traffic that originates outside of the endpoint and is entering the endpoint selected by the endpointSelector. \\n - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. \\n - If multiple members are set, all of them need to match in order for the rule to take effect. The exception to this rule is FromRequires field; the effects of any Requires field in any rule will apply to all other rules as well. \\n - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually exclusive. Only one of these members may be present within an individual rule.\",\"properties\":{\"fromCIDR\":{\"description\":\"FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. Only connections which do *not* originate from the cluster or from the local host are subject to CIDR rules. In order to allow in-cluster connectivity, use the FromEndpoints field. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.3.9.1\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"},\"fromCIDRSet\":{\"description\":\"FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. \\n Example: Any endpoint with the label \\\"app=my-legacy-pet\\\" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.\",\"items\":{\"description\":\"CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.\",\"oneOf\":[{\"properties\":{\"cidr\":{}},\"required\":[\"cidr\"]},{\"properties\":{\"cidrGroupRef\":{}},\"required\":[\"cidrGroupRef\"]}],\"properties\":{\"cidr\":{\"description\":\"CIDR is a CIDR prefix / IP Block.\",\"format\":\"cidr\",\"type\":\"string\"},\"cidrGroupRef\":{\"description\":\"CIDRGroupRef is a reference to a CiliumCIDRGroup object. A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive connections from.\",\"maxLength\":253,\"pattern\":\"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\",\"type\":\"string\"},\"except\":{\"description\":\"ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not supported yet. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.\",\"items\":{\"description\":\"CIDR specifies a block of IP addresses. Example: 192.0.2.1/32\",\"format\":\"cidr\",\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEndpoints\":{\"description\":\"FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. \\n Example: Any endpoint with the label \\\"role=backend\\\" can be consumed by any endpoint carrying the label \\\"role=frontend\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromEntities\":{\"description\":\"FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster` and `host`\",\"items\":{\"description\":\"Entity specifies the class of receiver/sender endpoints that do not have individual identities. Entities are used to describe \\\"outside of cluster\\\", \\\"host\\\", etc.\",\"enum\":[\"all\",\"world\",\"cluster\",\"host\",\"init\",\"ingress\",\"unmanaged\",\"remote-node\",\"health\",\"none\",\"kube-apiserver\"],\"type\":\"string\"},\"type\":\"array\"},\"fromGroups\":{\"description\":\"FromGroups is a directive that allows the integration with multiple outside providers. Currently, only AWS is supported, and the rule can select by multiple sub directives: \\n Example: FromGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'\",\"items\":{\"description\":\"Groups structure to store all kinds of new integrations that needs a new derivative policy.\",\"properties\":{\"aws\":{\"description\":\"AWSGroup is an structure that can be used to whitelisting information from AWS integration\",\"properties\":{\"labels\":{\"additionalProperties\":{\"type\":\"string\"},\"type\":\"object\"},\"region\":{\"type\":\"string\"},\"securityGroupsIds\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"securityGroupsNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromNodes\":{\"description\":\"FromNodes is a list of nodes identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule.\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"fromRequires\":{\"description\":\"FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. \\n Example: Any Endpoint with the label \\\"team=A\\\" requires consuming endpoint to also carry the label \\\"team=A\\\".\",\"items\":{\"description\":\"EndpointSelector is a wrapper for k8s LabelSelector.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"icmps\":{\"description\":\"ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is not allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can not accept incoming type 8 ICMP connections.\",\"items\":{\"description\":\"ICMPRule is a list of ICMP fields.\",\"properties\":{\"fields\":{\"description\":\"Fields is a list of ICMP fields.\",\"items\":{\"description\":\"ICMPField is a ICMP field.\",\"properties\":{\"family\":{\"default\":\"IPv4\",\"description\":\"Family is a IP address version. Currently, we support `IPv4` and `IPv6`. `IPv4` is set as default.\",\"enum\":[\"IPv4\",\"IPv6\"],\"type\":\"string\"},\"type\":{\"anyOf\":[{\"type\":\"integer\"},{\"type\":\"string\"}],\"description\":\"Type is a ICMP-type. It should be an 8bit code (0-255), or it's CamelCase name (for example, \\\"EchoReply\\\"). Allowed ICMP types are: Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest | RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem | Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem | EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport | MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation | NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery | ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement | HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation | MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix | ExtendedEchoRequest | ExtendedEchoReply\",\"pattern\":\"^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$\",\"x-kubernetes-int-or-string\":true}},\"required\":[\"type\"],\"type\":\"object\"},\"maxItems\":40,\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"toPorts\":{\"description\":\"ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is not allowed to receive connections on. \\n Example: Any endpoint with the label \\\"app=httpd\\\" can not accept incoming connections on port 80/tcp.\",\"items\":{\"description\":\"PortDenyRule is a list of ports/protocol that should be used for deny policies. This structure lacks the L7Rules since it's not supported in deny policies.\",\"properties\":{\"ports\":{\"description\":\"Ports is a list of L4 port/protocol\",\"items\":{\"description\":\"PortProtocol specifies an L4 port with an optional transport protocol\",\"properties\":{\"endPort\":{\"description\":\"EndPort can only be an L4 port number.\",\"format\":\"int32\",\"maximum\":65535,\"minimum\":0,\"type\":\"integer\"},\"port\":{\"description\":\"Port can be an L4 port number, or a name in the form of \\\"http\\\" or \\\"http-8080\\\".\",\"pattern\":\"^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$\",\"type\":\"string\"},\"protocol\":{\"description\":\"Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: \\\"TCP\\\", \\\"UDP\\\", \\\"SCTP\\\", \\\"ANY\\\" \\n Matching on ICMP is not supported. \\n Named port specified for a container may narrow this down, but may not contradict this.\",\"enum\":[\"TCP\",\"UDP\",\"SCTP\",\"ANY\"],\"type\":\"string\"}},\"required\":[\"port\"],\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"}},\"type\":\"object\"},\"type\":\"array\"},\"labels\":{\"description\":\"Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels.\",\"items\":{\"description\":\"Label is the Cilium's representation of a container label.\",\"properties\":{\"key\":{\"type\":\"string\"},\"source\":{\"description\":\"Source can be one of the above values (e.g.: LabelSourceContainer).\",\"type\":\"string\"},\"value\":{\"type\":\"string\"}},\"required\":[\"key\"],\"type\":\"object\"},\"type\":\"array\"},\"nodeSelector\":{\"description\":\"NodeSelector selects all nodes which should be subject to this rule. EndpointSelector and NodeSelector cannot be both empty and are mutually exclusive. Can only be used in CiliumClusterwideNetworkPolicies.\",\"properties\":{\"matchExpressions\":{\"description\":\"matchExpressions is a list of label selector requirements. The requirements are ANDed.\",\"items\":{\"description\":\"A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.\",\"properties\":{\"key\":{\"description\":\"key is the label key that the selector applies to.\",\"type\":\"string\"},\"operator\":{\"description\":\"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.\",\"enum\":[\"In\",\"NotIn\",\"Exists\",\"DoesNotExist\"],\"type\":\"string\"},\"values\":{\"description\":\"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.\",\"items\":{\"type\":\"string\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"}},\"required\":[\"key\",\"operator\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-type\":\"atomic\"},\"matchLabels\":{\"additionalProperties\":{\"description\":\"MatchLabelsValue represents the value from the MatchLabels {key,value} pair.\",\"maxLength\":63,\"pattern\":\"^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$\",\"type\":\"string\"},\"description\":\"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \\\"key\\\", the operator is \\\"In\\\", and the values array contains only \\\"value\\\". The requirements are ANDed.\",\"type\":\"object\"}},\"type\":\"object\"}},\"type\":\"object\"},\"type\":\"array\"},\"status\":{\"description\":\"Status is the status of the Cilium policy rule\",\"properties\":{\"conditions\":{\"items\":{\"properties\":{\"lastTransitionTime\":{\"description\":\"The last time the condition transitioned from one status to another.\",\"format\":\"date-time\",\"type\":\"string\"},\"message\":{\"description\":\"A human readable message indicating details about the transition.\",\"type\":\"string\"},\"reason\":{\"description\":\"The reason for the condition's last transition.\",\"type\":\"string\"},\"status\":{\"description\":\"The status of the condition, one of True, False, or Unknown\",\"type\":\"string\"},\"type\":{\"description\":\"The type of the policy condition\",\"type\":\"string\"}},\"required\":[\"status\",\"type\"],\"type\":\"object\"},\"type\":\"array\",\"x-kubernetes-list-map-keys\":[\"type\"],\"x-kubernetes-list-type\":\"map\"},\"derivativePolicies\":{\"additionalProperties\":{\"description\":\"CiliumNetworkPolicyNodeStatus is the status of a Cilium policy rule for a specific node.\",\"properties\":{\"annotations\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Annotations corresponds to the Annotations in the ObjectMeta of the CNP that have been realized on the node for CNP. That is, if a CNP has been imported and has been assigned annotation X=Y by the user, Annotations in CiliumNetworkPolicyNodeStatus will be X=Y once the CNP that was imported corresponding to Annotation X=Y has been realized on the node.\",\"type\":\"object\"},\"enforcing\":{\"description\":\"Enforcing is set to true once all endpoints present at the time the policy has been imported are enforcing this policy.\",\"type\":\"boolean\"},\"error\":{\"description\":\"Error describes any error that occurred when parsing or importing the policy, or realizing the policy for the endpoints to which it applies on the node.\",\"type\":\"string\"},\"lastUpdated\":{\"description\":\"LastUpdated contains the last time this status was updated\",\"format\":\"date-time\",\"type\":\"string\"},\"localPolicyRevision\":{\"description\":\"Revision is the policy revision of the repository which first implemented this policy.\",\"format\":\"int64\",\"type\":\"integer\"},\"ok\":{\"description\":\"OK is true when the policy has been parsed and imported successfully into the in-memory policy repository on the node.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"description\":\"DerivativePolicies is the status of all policies derived from the Cilium policy\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"metadata\"],\"type\":\"object\"}";
}
/// Register every keyword form this domain exposes onto the host
/// interpreter. Embedders call this once during boot.
pub fn register() {
tatara_lisp::register_all_capabilities!(CiliumNetworkPolicySpec);
tatara_lisp::domain::register_render::<CiliumNetworkPolicySpec>();
tatara_lisp::domain::register_schema::<CiliumNetworkPolicySpec>();
tatara_lisp::domain::register_attest::<CiliumNetworkPolicySpec>();
}