gateway_api/apis/experimental/
tlsroutes.rs

1// WARNING: generated file - manual changes will be overriden
2
3use super::common::*;
4#[allow(unused_imports)]
5mod prelude {
6    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
7    pub use kube_derive::CustomResource;
8    pub use schemars::JsonSchema;
9    pub use serde::{Deserialize, Serialize};
10}
11use self::prelude::*;
12/// Spec defines the desired state of TLSRoute.
13#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, JsonSchema, Default, PartialEq)]
14#[kube(
15    group = "gateway.networking.k8s.io",
16    version = "v1alpha2",
17    kind = "TLSRoute",
18    plural = "tlsroutes"
19)]
20#[kube(namespaced)]
21#[kube(status = "RouteStatus")]
22#[kube(derive = "Default")]
23#[kube(derive = "PartialEq")]
24pub struct TLSRouteSpec {
25    /// Hostnames defines a set of SNI names that should match against the
26    /// SNI attribute of TLS ClientHello message in TLS handshake. This matches
27    /// the RFC 1123 definition of a hostname with 2 notable exceptions:
28    ///
29    /// 1. IPs are not allowed in SNI names per RFC 6066.
30    /// 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
31    ///    label must appear by itself as the first label.
32    ///
33    /// If a hostname is specified by both the Listener and TLSRoute, there
34    /// must be at least one intersecting hostname for the TLSRoute to be
35    /// attached to the Listener. For example:
36    ///
37    /// * A Listener with `test.example.com` as the hostname matches TLSRoutes
38    ///   that have either not specified any hostnames, or have specified at
39    ///   least one of `test.example.com` or `*.example.com`.
40    /// * A Listener with `*.example.com` as the hostname matches TLSRoutes
41    ///   that have either not specified any hostnames or have specified at least
42    ///   one hostname that matches the Listener hostname. For example,
43    ///   `test.example.com` and `*.example.com` would both match. On the other
44    ///   hand, `example.com` and `test.example.net` would not match.
45    ///
46    /// If both the Listener and TLSRoute have specified hostnames, any
47    /// TLSRoute hostnames that do not match the Listener hostname MUST be
48    /// ignored. For example, if a Listener specified `*.example.com`, and the
49    /// TLSRoute specified `test.example.com` and `test.example.net`,
50    /// `test.example.net` must not be considered for a match.
51    ///
52    /// If both the Listener and TLSRoute have specified hostnames, and none
53    /// match with the criteria above, then the TLSRoute is not accepted. The
54    /// implementation must raise an 'Accepted' Condition with a status of
55    /// `False` in the corresponding RouteParentStatus.
56    ///
57    /// Support: Core
58    #[serde(default, skip_serializing_if = "Option::is_none")]
59    pub hostnames: Option<Vec<String>>,
60    /// ParentRefs references the resources (usually Gateways) that a Route wants
61    /// to be attached to. Note that the referenced parent resource needs to
62    /// allow this for the attachment to be complete. For Gateways, that means
63    /// the Gateway needs to allow attachment from Routes of this kind and
64    /// namespace. For Services, that means the Service must either be in the same
65    /// namespace for a "producer" route, or the mesh implementation must support
66    /// and allow "consumer" routes for the referenced Service. ReferenceGrant is
67    /// not applicable for governing ParentRefs to Services - it is not possible to
68    /// create a "producer" route for a Service in a different namespace from the
69    /// Route.
70    ///
71    /// There are two kinds of parent resources with "Core" support:
72    ///
73    /// * Gateway (Gateway conformance profile)
74    /// * Service (Mesh conformance profile, ClusterIP Services only)
75    ///
76    /// This API may be extended in the future to support additional kinds of parent
77    /// resources.
78    ///
79    /// ParentRefs must be _distinct_. This means either that:
80    ///
81    /// * They select different objects.  If this is the case, then parentRef
82    ///   entries are distinct. In terms of fields, this means that the
83    ///   multi-part key defined by `group`, `kind`, `namespace`, and `name` must
84    ///   be unique across all parentRef entries in the Route.
85    /// * They do not select different objects, but for each optional field used,
86    ///   each ParentRef that selects the same object must set the same set of
87    ///   optional fields to different values. If one ParentRef sets a
88    ///   combination of optional fields, all must set the same combination.
89    ///
90    /// Some examples:
91    ///
92    /// * If one ParentRef sets `sectionName`, all ParentRefs referencing the
93    ///   same object must also set `sectionName`.
94    /// * If one ParentRef sets `port`, all ParentRefs referencing the same
95    ///   object must also set `port`.
96    /// * If one ParentRef sets `sectionName` and `port`, all ParentRefs
97    ///   referencing the same object must also set `sectionName` and `port`.
98    ///
99    /// It is possible to separately reference multiple distinct objects that may
100    /// be collapsed by an implementation. For example, some implementations may
101    /// choose to merge compatible Gateway Listeners together. If that is the
102    /// case, the list of routes attached to those resources should also be
103    /// merged.
104    ///
105    /// Note that for ParentRefs that cross namespace boundaries, there are specific
106    /// rules. Cross-namespace references are only valid if they are explicitly
107    /// allowed by something in the namespace they are referring to. For example,
108    /// Gateway has the AllowedRoutes field, and ReferenceGrant provides a
109    /// generic way to enable other kinds of cross-namespace reference.
110    ///
111    ///
112    /// ParentRefs from a Route to a Service in the same namespace are "producer"
113    /// routes, which apply default routing rules to inbound connections from
114    /// any namespace to the Service.
115    ///
116    /// ParentRefs from a Route to a Service in a different namespace are
117    /// "consumer" routes, and these routing rules are only applied to outbound
118    /// connections originating from the same namespace as the Route, for which
119    /// the intended destination of the connections are a Service targeted as a
120    /// ParentRef of the Route.
121    ///
122    ///
123    ///
124    ///
125    ///
126    ///
127    #[serde(
128        default,
129        skip_serializing_if = "Option::is_none",
130        rename = "parentRefs"
131    )]
132    pub parent_refs: Option<Vec<ParentReference>>,
133    /// Rules are a list of TLS matchers and actions.
134    ///
135    ///
136    pub rules: Vec<CommonRouteRule>,
137}
gateway_api/apis/experimental/tlsroutes.rs

gateway_api/apis/experimental/
tlsroutes.rs
