Struct GatewayTlsFrontendDefaultValidation 

pub struct GatewayTlsFrontendDefaultValidation {
    pub ca_certificate_refs: Vec<GatewayTlsFrontendDefaultValidationCaCertificateRefs>,
    pub mode: Option<GatewayTlsFrontendDefaultValidationMode>,
}

Validation holds configuration information for validating the frontend (client). Setting this field will result in mutual authentication when connecting to the gateway. In browsers this may result in a dialog appearing that requests a user to specify the client certificate. The maximum depth of a certificate chain accepted in verification is Implementation specific.

Support: Core

Fields

ca_certificate_refs: Vec<GatewayTlsFrontendDefaultValidationCaCertificateRefs>

CACertificateRefs contains one or more references to Kubernetes objects that contain a PEM-encoded TLS CA certificate bundle, which is used as a trust anchor to validate the certificates presented by the client.

A CACertificateRef is invalid if:

• It refers to a resource that cannot be resolved (e.g., the referenced resource does not exist) or is misconfigured (e.g., a ConfigMap does not contain a key named ca.crt). In this case, the Reason on all matching HTTPS listeners must be set to InvalidCACertificateRef and the Message of the Condition must indicate which reference is invalid and why.

• It refers to an unknown or unsupported kind of resource. In this case, the Reason on all matching HTTPS listeners must be set to InvalidCACertificateKind and the Message of the Condition must explain which kind of resource is unknown or unsupported.

• It refers to a resource in another namespace UNLESS there is a ReferenceGrant in the target namespace that allows the CA certificate to be attached. If a ReferenceGrant does not allow this reference, the ResolvedRefs on all matching HTTPS listeners condition MUST be set with the Reason RefNotPermitted.

Implementations MAY choose to perform further validation of the certificate content (e.g., checking expiry or enforcing specific formats). In such cases, an implementation-specific Reason and Message MUST be set.

In all cases, the implementation MUST ensure that the ResolvedRefs condition is set to status: False on all targeted listeners (i.e., listeners serving HTTPS on a matching port). The condition MUST include a Reason and Message that indicate the cause of the error. If ALL CACertificateRefs are invalid, the implementation MUST also ensure the Accepted condition on the listener is set to status: False, with the Reason NoValidCACertificate. Implementations MAY choose to support attaching multiple CA certificates to a listener, but this behavior is implementation-specific.

Support: Core - A single reference to a Kubernetes ConfigMap, with the CA certificate in a key named ca.crt.

Support: Implementation-specific - More than one reference, other kinds of resources, or a single reference that includes multiple certificates.

mode: Option<GatewayTlsFrontendDefaultValidationMode>

FrontendValidationMode defines the mode for validating the client certificate. There are two possible modes:

• AllowValidOnly: In this mode, the gateway will accept connections only if the client presents a valid certificate. This certificate must successfully pass validation against the CA certificates specified in CACertificateRefs.

• AllowInsecureFallback: In this mode, the gateway will accept connections even if the client certificate is not presented or fails verification.

  This approach delegates client authorization to the backend and introduce a significant security risk. It should be used in testing environments or on a temporary basis in non-testing environments.

Defaults to AllowValidOnly.

Support: Core

Trait Implementations

impl Clone for GatewayTlsFrontendDefaultValidation

fn clone(&self) -> GatewayTlsFrontendDefaultValidation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GatewayTlsFrontendDefaultValidation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for GatewayTlsFrontendDefaultValidation

fn default() -> GatewayTlsFrontendDefaultValidation

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for GatewayTlsFrontendDefaultValidation

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for GatewayTlsFrontendDefaultValidation

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for GatewayTlsFrontendDefaultValidation

fn eq(&self, other: &GatewayTlsFrontendDefaultValidation) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for GatewayTlsFrontendDefaultValidation

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for GatewayTlsFrontendDefaultValidation