{
  "openapi": "3.0.0",
  "info": {
    "title": "Configuration affecting edge load balancer.",
    "version": "v1beta1"
  },
  "components": {
    "schemas": {
      "istio.networking.v1beta1.Gateway": {
        "description": "Gateway describes a load balancer operating at the edge of the mesh receiving incoming or outgoing HTTP/TCP connections.",
        "type": "object",
        "properties": {
          "servers": {
            "description": "A list of server specifications.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.networking.v1beta1.Server"
            }
          },
          "selector": {
            "description": "One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. By default workloads are searched across all namespaces based on label selectors. This implies that a gateway resource in the namespace \"foo\" can select pods in the namespace \"bar\" based on labels. This behavior can be controlled via the `PILOT_SCOPE_GATEWAY_TO_NAMESPACE` environment variable in istiod. If this variable is set to true, the scope of label search is restricted to the configuration namespace in which the the resource is present. In other words, the Gateway resource must reside in the same namespace as the gateway workload instance. If selector is nil, the Gateway will be applied to all workloads.",
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1beta1.Server": {
        "description": "`Server` describes the properties of the proxy on a given load balancer port. For example,",
        "type": "object",
        "properties": {
          "name": {
            "description": "An optional name of the server, when set must be unique across all servers. This will be used for variety of purposes like prefixing stats generated with this name etc.",
            "type": "string",
            "format": "string"
          },
          "tls": {
            "$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings"
          },
          "port": {
            "$ref": "#/components/schemas/istio.networking.v1beta1.Port"
          },
          "bind": {
            "description": "The ip or the Unix domain socket to which the listener should be bound to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). When using Unix domain sockets, the port number should be 0.",
            "type": "string",
            "format": "string"
          },
          "hosts": {
            "description": "One or more hosts exposed by this gateway. While typically applicable to HTTP services, it can also be used for TCP services using TLS with SNI. A host is specified as a `dnsName` with an optional `namespace/` prefix. The `dnsName` should be specified using FQDN format, optionally including a wildcard character in the left-most component (e.g., `prod/*.example.com`). Set the `dnsName` to `*` to select all `VirtualService` hosts from the specified namespace (e.g.,`prod/*`).",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "defaultEndpoint": {
            "description": "The loopback IP endpoint or Unix domain socket to which traffic should be forwarded to by default. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace). NOT IMPLEMENTED. $hide_from_docs",
            "type": "string",
            "format": "string"
          }
        }
      },
      "istio.networking.v1beta1.Port": {
        "description": "Port describes the properties of a specific port of a service.",
        "type": "object",
        "properties": {
          "number": {
            "description": "A valid non-negative integer port number.",
            "type": "integer"
          },
          "name": {
            "description": "Label assigned to the port.",
            "type": "string",
            "format": "string"
          },
          "protocol": {
            "description": "The protocol exposed on the port. MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection.",
            "type": "string",
            "format": "string"
          },
          "targetPort": {
            "description": "The port number on the endpoint where the traffic will be received. Applicable only when used with ServiceEntries.",
            "type": "integer"
          }
        }
      },
      "istio.networking.v1beta1.ServerTLSSettings": {
        "type": "object",
        "properties": {
          "mode": {
            "$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSmode"
          },
          "privateKey": {
            "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server's private key.",
            "type": "string",
            "format": "string"
          },
          "caCertificates": {
            "description": "REQUIRED if mode is `MUTUAL`. The path to a file containing certificate authority certificates to use in verifying a presented client side certificate.",
            "type": "string",
            "format": "string"
          },
          "credentialName": {
            "description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. Applicable only on Kubernetes, and only if the dynamic credential fetching feature is enabled in the proxy by setting `ISTIO_META_USER_SDS` metadata variable. The secret (of type `generic`) should contain the following keys and values: `key: \u003cprivateKey\u003e` and `cert: \u003cserverCert\u003e`. For mutual TLS, `cacert: \u003cCACertificate\u003e` can be provided in the same secret or a separate secret named `\u003csecret\u003e-cacert`. Secret of type tls for server certificates along with ca.crt key for CA certificates is also supported. Only one of server certificates and CA certificate or credentialName can be specified.",
            "type": "string",
            "format": "string"
          },
          "subjectAltNames": {
            "description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "httpsRedirect": {
            "description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
            "type": "boolean"
          },
          "serverCertificate": {
            "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server-side TLS certificate to use.",
            "type": "string",
            "format": "string"
          },
          "verifyCertificateSpki": {
            "description": "An optional list of base64-encoded SHA-256 hashes of the SKPIs of authorized client certificates. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "verifyCertificateHash": {
            "description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. Both simple and colon separated formats are acceptable. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          },
          "minProtocolVersion": {
            "$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
          },
          "maxProtocolVersion": {
            "$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
          },
          "cipherSuites": {
            "description": "Optional: If specified, only support the specified cipher list. Otherwise default to the default cipher list supported by Envoy.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1beta1.ServerTLSSettings.TLSmode": {
        "description": "TLS modes enforced by the proxy",
        "type": "string",
        "enum": [
          "PASSTHROUGH",
          "SIMPLE",
          "MUTUAL",
          "AUTO_PASSTHROUGH",
          "ISTIO_MUTUAL"
        ]
      },
      "istio.networking.v1beta1.ServerTLSSettings.TLSProtocol": {
        "description": "TLS protocol versions.",
        "type": "string",
        "enum": [
          "TLS_AUTO",
          "TLSV1_0",
          "TLSV1_1",
          "TLSV1_2",
          "TLSV1_3"
        ]
      }
    }
  }
}