Struct GatewayTlsFrontendPerPortTlsValidation 

pub struct GatewayTlsFrontendPerPortTlsValidation {
    pub ca_certificate_refs: Vec<GatewayTlsFrontendPerPortTlsValidationCaCertificateRefs>,
    pub mode: Option<GatewayTlsFrontendPerPortTlsValidationMode>,
}

Validation holds configuration information for validating the frontend (client). Setting this field will result in mutual authentication when connecting to the gateway. In browsers this may result in a dialog appearing that requests a user to specify the client certificate. The maximum depth of a certificate chain accepted in verification is Implementation specific.

Support: Core

Fields

ca_certificate_refs: Vec<GatewayTlsFrontendPerPortTlsValidationCaCertificateRefs>

CACertificateRefs contains one or more references to Kubernetes objects that contain TLS certificates of the Certificate Authorities that can be used as a trust anchor to validate the certificates presented by the client.

A single CA certificate reference to a Kubernetes ConfigMap has “Core” support. Implementations MAY choose to support attaching multiple CA certificates to a Listener, but this behavior is implementation-specific.

Support: Core - A single reference to a Kubernetes ConfigMap with the CA certificate in a key named ca.crt.

Support: Implementation-specific (More than one certificate in a ConfigMap with different keys or more than one reference, or other kinds of resources).

References to a resource in a different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the “ResolvedRefs” condition MUST be set to False for this listener with the “RefNotPermitted” reason.

mode: Option<GatewayTlsFrontendPerPortTlsValidationMode>

FrontendValidationMode defines the mode for validating the client certificate. There are two possible modes:

• AllowValidOnly: In this mode, the gateway will accept connections only if the client presents a valid certificate. This certificate must successfully pass validation against the CA certificates specified in CACertificateRefs.

• AllowInsecureFallback: In this mode, the gateway will accept connections even if the client certificate is not presented or fails verification.

  This approach delegates client authorization to the backend and introduce a significant security risk. It should be used in testing environments or on a temporary basis in non-testing environments.

Defaults to AllowValidOnly.

Support: Core

Trait Implementations

impl Clone for GatewayTlsFrontendPerPortTlsValidation

fn clone(&self) -> GatewayTlsFrontendPerPortTlsValidation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GatewayTlsFrontendPerPortTlsValidation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for GatewayTlsFrontendPerPortTlsValidation

fn default() -> GatewayTlsFrontendPerPortTlsValidation

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for GatewayTlsFrontendPerPortTlsValidation

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for GatewayTlsFrontendPerPortTlsValidation

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for GatewayTlsFrontendPerPortTlsValidation

fn eq(&self, other: &GatewayTlsFrontendPerPortTlsValidation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for GatewayTlsFrontendPerPortTlsValidation

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for GatewayTlsFrontendPerPortTlsValidation