{
  "openapi": "3.0.0",
  "info": {
    "title": "Configuration affecting network reachability of a sidecar.",
    "version": "v1alpha3"
  },
  "components": {
    "schemas": {
      "istio.networking.v1alpha3.ClientTLSSettings": {
        "description": "SSL/TLS related settings for upstream connections. See Envoy's [TLS context](https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/auth/cert.proto.html) for more details. These settings are common to both HTTP and TCP upstreams.",
        "type": "object",
        "properties": {
          "mode": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ClientTLSSettings.TLSmode"
          },
          "clientCertificate": {
            "description": "REQUIRED if mode is `MUTUAL`. The path to the file holding the client-side TLS certificate to use. Should be empty if mode is `ISTIO_MUTUAL`.",
            "type": "string",
            "format": "string"
          },
          "privateKey": {
            "description": "REQUIRED if mode is `MUTUAL`. The path to the file holding the client's private key. Should be empty if mode is `ISTIO_MUTUAL`.",
            "type": "string",
            "format": "string"
          },
          "caCertificates": {
            "description": "OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate. If omitted, the proxy will not verify the server's certificate. Should be empty if mode is `ISTIO_MUTUAL`.",
            "type": "string",
            "format": "string"
          },
          "subjectAltNames": {
            "description": "A list of alternate names to verify the subject identity in the certificate. If specified, the proxy will verify that the server certificate's subject alt name matches one of the specified values. If specified, this list overrides the value of subject_alt_names from the ServiceEntry.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "sni": {
            "description": "SNI string to present to the server during TLS handshake.",
            "type": "string",
            "format": "string"
          }
        }
      },
      "istio.networking.v1alpha3.PortSelector": {
        "description": "PortSelector specifies the number of a port to be used for matching or selection for final routing.",
        "type": "object",
        "properties": {
          "number": {
            "description": "Valid port number",
            "type": "integer"
          }
        }
      },
      "istio.networking.v1alpha3.ClientTLSSettings.TLSmode": {
        "description": "TLS connection mode",
        "type": "string",
        "enum": [
          "DISABLE",
          "SIMPLE",
          "MUTUAL",
          "ISTIO_MUTUAL"
        ]
      },
      "istio.networking.v1alpha3.WorkloadSelector": {
        "description": "`WorkloadSelector` specifies the criteria used to determine if the `Gateway`, `Sidecar`, or `EnvoyFilter` or `ServiceEntry` configuration can be applied to a proxy. The matching criteria includes the metadata associated with a proxy, workload instance info such as labels attached to the pod/VM, or any other info that the proxy provides to Istio during the initial handshake. If multiple conditions are specified, all conditions need to match in order for the workload instance to be selected. Currently, only label based selection mechanism is supported.",
        "type": "object",
        "properties": {
          "labels": {
            "description": "One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. The scope of label search is restricted to the configuration namespace in which the the resource is present.",
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1alpha3.Port": {
        "description": "Port describes the properties of a specific port of a service.",
        "type": "object",
        "properties": {
          "number": {
            "description": "A valid non-negative integer port number.",
            "type": "integer"
          },
          "name": {
            "description": "Label assigned to the port.",
            "type": "string",
            "format": "string"
          },
          "protocol": {
            "description": "The protocol exposed on the port. MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection.",
            "type": "string",
            "format": "string"
          }
        }
      },
      "istio.networking.v1alpha3.ServerTLSSettings": {
        "type": "object",
        "properties": {
          "mode": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ServerTLSSettings.TLSmode"
          },
          "privateKey": {
            "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server's private key.",
            "type": "string",
            "format": "string"
          },
          "caCertificates": {
            "description": "REQUIRED if mode is `MUTUAL`. The path to a file containing certificate authority certificates to use in verifying a presented client side certificate.",
            "type": "string",
            "format": "string"
          },
          "subjectAltNames": {
            "description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "httpsRedirect": {
            "description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
            "type": "boolean"
          },
          "serverCertificate": {
            "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server-side TLS certificate to use.",
            "type": "string",
            "format": "string"
          },
          "credentialName": {
            "description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. Applicable only on Kubernetes, and only if the dynamic credential fetching feature is enabled in the proxy by setting `ISTIO_META_USER_SDS` metadata variable. The secret (of type `generic`) should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cserverCert\u003e`, `cacert: \u003cCACertificate\u003e`.",
            "type": "string",
            "format": "string"
          },
          "verifyCertificateSpki": {
            "description": "An optional list of base64-encoded SHA-256 hashes of the SKPIs of authorized client certificates. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "verifyCertificateHash": {
            "description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. Both simple and colon separated formats are acceptable. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "minProtocolVersion": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ServerTLSSettings.TLSProtocol"
          },
          "maxProtocolVersion": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ServerTLSSettings.TLSProtocol"
          },
          "cipherSuites": {
            "description": "Optional: If specified, only support the specified cipher list. Otherwise default to the default cipher list supported by Envoy.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1alpha3.ServerTLSSettings.TLSmode": {
        "description": "TLS modes enforced by the proxy",
        "type": "string",
        "enum": [
          "PASSTHROUGH",
          "SIMPLE",
          "MUTUAL",
          "AUTO_PASSTHROUGH",
          "ISTIO_MUTUAL"
        ]
      },
      "istio.networking.v1alpha3.ServerTLSSettings.TLSProtocol": {
        "description": "TLS protocol versions.",
        "type": "string",
        "enum": [
          "TLS_AUTO",
          "TLSV1_0",
          "TLSV1_1",
          "TLSV1_2",
          "TLSV1_3"
        ]
      },
      "istio.networking.v1alpha3.Sidecar": {
        "description": "`Sidecar` describes the configuration of the sidecar proxy that mediates inbound and outbound communication of the workload instance to which it is attached.",
        "type": "object",
        "properties": {
          "workloadSelector": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.WorkloadSelector"
          },
          "ingress": {
            "description": "Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. If omitted, Istio will automatically configure the sidecar based on the information about the workload obtained from the orchestration platform (e.g., exposed ports, services, etc.). If specified, inbound ports are configured if and only if the workload instance is associated with a service.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.networking.v1alpha3.IstioIngressListener"
            }
          },
          "egress": {
            "description": "Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. If not specified, inherits the system detected defaults from the namespace-wide or the global default Sidecar.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.networking.v1alpha3.IstioEgressListener"
            }
          },
          "outboundTrafficPolicy": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.OutboundTrafficPolicy"
          },
          "localhost": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.Localhost"
          }
        }
      },
      "istio.networking.v1alpha3.IstioIngressListener": {
        "description": "`IstioIngressListener` specifies the properties of an inbound traffic listener on the sidecar proxy attached to a workload instance.",
        "type": "object",
        "properties": {
          "port": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.Port"
          },
          "bind": {
            "description": "The IP to which the listener should be bound. Must be in the format `x.x.x.x`. Unix domain socket addresses are not allowed in the bind field for ingress listeners. If omitted, Istio will automatically configure the defaults based on imported services and the workload instances to which this configuration is applied to.",
            "type": "string",
            "format": "string"
          },
          "defaultEndpoint": {
            "description": "The loopback IP endpoint or Unix domain socket to which traffic should be forwarded to. This configuration can be used to redirect traffic arriving at the bind `IP:Port` on the sidecar to a `localhost:port` or Unix domain socket where the application workload instance is listening for connections. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket`",
            "type": "string",
            "format": "string"
          },
          "captureMode": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.CaptureMode"
          },
          "localhostClientTls": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ClientTLSSettings"
          }
        }
      },
      "istio.networking.v1alpha3.IstioEgressListener": {
        "description": "`IstioEgressListener` specifies the properties of an outbound traffic listener on the sidecar proxy attached to a workload instance.",
        "type": "object",
        "properties": {
          "port": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.Port"
          },
          "bind": {
            "description": "The IP or the Unix domain socket to which the listener should be bound to. Port MUST be specified if bind is not empty. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). If omitted, Istio will automatically configure the defaults based on imported services, the workload instances to which this configuration is applied to and the captureMode. If captureMode is `NONE`, bind will default to 127.0.0.1.",
            "type": "string",
            "format": "string"
          },
          "hosts": {
            "description": "One or more service hosts exposed by the listener in `namespace/dnsName` format. Services in the specified namespace matching `dnsName` will be exposed. The corresponding service can be a service in the service registry (e.g., a Kubernetes or cloud foundry service) or a service specified using a `ServiceEntry` or `VirtualService` configuration. Any associated `DestinationRule` in the same namespace will also be used.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "captureMode": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.CaptureMode"
          },
          "localhostServerTls": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ServerTLSSettings"
          }
        }
      },
      "istio.networking.v1alpha3.OutboundTrafficPolicy": {
        "description": "`OutboundTrafficPolicy` sets the default behavior of the sidecar for handling outbound traffic from the application. If your application uses one or more external services that are not known apriori, setting the policy to `ALLOW_ANY` will cause the sidecars to route any unknown traffic originating from the application to its requested destination. Users are strongly encouraged to use `ServiceEntry` configurations to explicitly declare any external dependencies, instead of using `ALLOW_ANY`, so that traffic to these services can be monitored.",
        "type": "object",
        "properties": {
          "mode": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.OutboundTrafficPolicy.Mode"
          },
          "egressProxy": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.Destination"
          }
        }
      },
      "istio.networking.v1alpha3.Localhost": {
        "description": "`Localhost` describes the sidecar settings related to the communication between the sidecar and the workload it is attached to in a Kubernetes Pod or a VM. These settings apply by default to all ingress and egress listeners in a sidecar unless overridden.",
        "type": "object",
        "properties": {
          "clientTls": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ClientTLSSettings"
          },
          "serverTls": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.ServerTLSSettings"
          }
        }
      },
      "istio.networking.v1alpha3.CaptureMode": {
        "description": "`CaptureMode` describes how traffic to a listener is expected to be captured. Applicable only when the listener is bound to an IP.",
        "type": "string",
        "enum": [
          "DEFAULT",
          "IPTABLES",
          "NONE"
        ]
      },
      "istio.networking.v1alpha3.OutboundTrafficPolicy.Mode": {
        "type": "string",
        "enum": [
          "REGISTRY_ONLY",
          "ALLOW_ANY"
        ]
      },
      "istio.networking.v1alpha3.Destination": {
        "description": "Destination indicates the network addressable service to which the request/connection will be sent after processing a routing rule. The destination.host should unambiguously refer to a service in the service registry. Istio's service registry is composed of all the services found in the platform's service registry (e.g., Kubernetes services, Consul services), as well as services declared through the [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry) resource.",
        "type": "object",
        "properties": {
          "host": {
            "description": "The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped.",
            "type": "string",
            "format": "string"
          },
          "port": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.PortSelector"
          },
          "subset": {
            "description": "The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule.",
            "type": "string",
            "format": "string"
          }
        }
      }
    }
  }
}