{
  "openapi": "3.0.0",
  "info": {
    "title": "Customizing Envoy configuration generated by Istio.",
    "version": "v1alpha3"
  },
  "components": {
    "schemas": {
      "istio.networking.v1alpha3.EnvoyFilter": {
        "description": "EnvoyFilter provides a mechanism to customize the Envoy configuration generated by Istio Pilot.",
        "type": "object",
        "properties": {
          "workloadLabels": {
            "description": "Deprecated. Use workload_selector instead. $hide_from_docs",
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "format": "string"
            },
            "deprecated": true
          },
          "filters": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.Filter"
            },
            "deprecated": true
          },
          "workloadSelector": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.WorkloadSelector"
          },
          "configPatches": {
            "description": "One or more patches with match conditions.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.EnvoyConfigObjectPatch"
            }
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.Filter": {
        "description": "Deprecated. Envoy filters to be added to a network or http filter chain. $hide_from_docs",
        "type": "object",
        "properties": {
          "listenerMatch": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.DeprecatedListenerMatch"
          },
          "insertPosition": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.InsertPosition"
          },
          "filterType": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.Filter.FilterType"
          },
          "filterName": {
            "description": "The name of the filter to instantiate. The name must match a supported filter _compiled into_ Envoy.",
            "type": "string",
            "format": "string"
          },
          "filterConfig": {
            "description": "Filter specific configuration which depends on the filter being instantiated.",
            "type": "object"
          }
        }
      },
      "istio.networking.v1alpha3.WorkloadSelector": {
        "description": "`WorkloadSelector` specifies the criteria used to determine if the `Gateway`, `Sidecar`, or `EnvoyFilter` configuration can be applied to a proxy. The matching criteria includes the metadata associated with a proxy, workload instance info such as labels attached to the pod/VM, or any other info that the proxy provides to Istio during the initial handshake. If multiple conditions are specified, all conditions need to match in order for the workload instance to be selected. Currently, only label based selection mechanism is supported.",
        "type": "object",
        "properties": {
          "labels": {
            "description": "One or more labels that indicate a specific set of pods/VMs on which this `Sidecar` configuration should be applied. The scope of label search is restricted to the configuration namespace in which the the resource is present.",
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.EnvoyConfigObjectPatch": {
        "description": "Changes to be made to various envoy config objects.",
        "type": "object",
        "properties": {
          "applyTo": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ApplyTo"
          },
          "match": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.EnvoyConfigObjectMatch"
          },
          "patch": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.Patch"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.DeprecatedListenerMatch": {
        "description": "Deprecated. Select a listener to add the filter to based on the match conditions. All conditions specified in the ListenerMatch must be met for the filter to be applied to a listener. $hide_from_docs",
        "type": "object",
        "properties": {
          "portNumber": {
            "description": "The service port/gateway port to which traffic is being sent/received. If not specified, matches all listeners. Even though inbound listeners are generated for the instance/pod ports, only service ports should be used to match listeners.",
            "type": "integer"
          },
          "portNamePrefix": {
            "description": "Instead of using specific port numbers, a set of ports matching a given port name prefix can be selected. E.g., \"mongo\" selects ports named mongo-port, mongo, mongoDB, MONGO, etc. Matching is case insensitive.",
            "type": "string",
            "format": "string"
          },
          "listenerType": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.DeprecatedListenerMatch.ListenerType"
          },
          "listenerProtocol": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.DeprecatedListenerMatch.ListenerProtocol"
          },
          "address": {
            "description": "One or more IP addresses to which the listener is bound. If specified, should match at least one address in the list.",
            "type": "array",
            "items": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.DeprecatedListenerMatch.ListenerType": {
        "type": "string",
        "enum": [
          "ANY",
          "SIDECAR_INBOUND",
          "SIDECAR_OUTBOUND",
          "GATEWAY"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.DeprecatedListenerMatch.ListenerProtocol": {
        "type": "string",
        "enum": [
          "ALL",
          "HTTP",
          "TCP"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.InsertPosition": {
        "description": "Deprecated. Indicates the relative index in the filter chain where the filter should be inserted. $hide_from_docs",
        "type": "object",
        "properties": {
          "index": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.InsertPosition.Index"
          },
          "relativeTo": {
            "description": "If BEFORE or AFTER position is specified, specify the name of the filter relative to which this filter should be inserted.",
            "type": "string",
            "format": "string"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.InsertPosition.Index": {
        "description": "Index/position in the filter chain.",
        "type": "string",
        "enum": [
          "FIRST",
          "LAST",
          "BEFORE",
          "AFTER"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.Filter.FilterType": {
        "type": "string",
        "enum": [
          "INVALID",
          "HTTP",
          "NETWORK"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.ApplyTo": {
        "description": "ApplyTo specifies where in the Envoy configuration, the given patch should be applied.",
        "type": "string",
        "enum": [
          "INVALID",
          "LISTENER",
          "FILTER_CHAIN",
          "NETWORK_FILTER",
          "HTTP_FILTER",
          "ROUTE_CONFIGURATION",
          "VIRTUAL_HOST",
          "HTTP_ROUTE",
          "CLUSTER"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.PatchContext": {
        "description": "PatchContext selects a class of configurations based on the traffic flow direction and workload type.",
        "type": "string",
        "enum": [
          "ANY",
          "SIDECAR_INBOUND",
          "SIDECAR_OUTBOUND",
          "GATEWAY"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.ProxyMatch": {
        "description": "One or more properties of the proxy to match on.",
        "type": "object",
        "properties": {
          "proxyVersion": {
            "description": "A regular expression in golang regex format (RE2) that can be used to select proxies using a specific version of istio proxy. The Istio version for a given proxy is obtained from the node metadata field ISTIO_VERSION supplied by the proxy when connecting to Pilot. This value is embedded as an environment variable (ISTIO_META_ISTIO_VERSION) in the Istio proxy docker image. Custom proxy implementations should provide this metadata variable to take advantage of the Istio version check option.",
            "type": "string",
            "format": "string"
          },
          "metadata": {
            "description": "Match on the node metadata supplied by a proxy when connecting to Istio Pilot. Note that while Envoy's node metadata is of type Struct, only string key-value pairs are processed by Pilot. All keys specified in the metadata must match with exact values. The match will fail if any of the specified keys are absent or the values fail to match.",
            "type": "object",
            "additionalProperties": {
              "type": "string",
              "format": "string"
            }
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.ClusterMatch": {
        "description": "Conditions specified in ClusterMatch must be met for the patch to be applied to a cluster.",
        "type": "object",
        "properties": {
          "name": {
            "description": "The exact name of the cluster to match. To match a specific cluster by name, such as the internally generated \"Passthrough\" cluster, leave all fields in clusterMatch empty, except the name.",
            "type": "string",
            "format": "string"
          },
          "portNumber": {
            "description": "The service port for which this cluster was generated. If omitted, applies to clusters for any port.",
            "type": "integer"
          },
          "service": {
            "description": "The fully qualified service name for this cluster. If omitted, applies to clusters for any service. For services defined through service entries, the service name is same as the hosts defined in the service entry.",
            "type": "string",
            "format": "string"
          },
          "subset": {
            "description": "The subset associated with the service. If omitted, applies to clusters for any subset of a service.",
            "type": "string",
            "format": "string"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch": {
        "description": "Conditions specified in RouteConfigurationMatch must be met for the patch to be applied to a route configuration object or a specific virtual host within the route configuration.",
        "type": "object",
        "properties": {
          "name": {
            "description": "Route configuration name to match on. Can be used to match a specific route configuration by name, such as the internally generated \"http_proxy\" route configuration for all sidecars.",
            "type": "string",
            "format": "string"
          },
          "portNumber": {
            "description": "The service port number or gateway server port number for which this route configuration was generated. If omitted, applies to route configurations for all ports.",
            "type": "integer"
          },
          "portName": {
            "description": "Applicable only for GATEWAY context. The gateway server port name for which this route configuration was generated.",
            "type": "string",
            "format": "string"
          },
          "gateway": {
            "description": "The Istio gateway config's namespace/name for which this route configuration was generated. Applies only if the context is GATEWAY. Should be in the namespace/name format. Use this field in conjunction with the portNumber and portName to accurately select the Envoy route configuration for a specific HTTPS server within a gateway config object.",
            "type": "string",
            "format": "string"
          },
          "vhost": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch.VirtualHostMatch"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch.VirtualHostMatch": {
        "description": "Match a specific virtual host inside a route configuration.",
        "type": "object",
        "properties": {
          "name": {
            "description": "The VirtualHosts objects generated by Istio are named as host:port, where the host typically corresponds to the VirtualService's host field or the hostname of a service in the registry.",
            "type": "string",
            "format": "string"
          },
          "route": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch.RouteMatch"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch.RouteMatch": {
        "description": "Match a specific route inside a virtual host in a route configuration.",
        "type": "object",
        "properties": {
          "name": {
            "description": "The Route objects generated by default are named as \"default\". Route objects generated using a virtual service will carry the name used in the virtual service's HTTP routes.",
            "type": "string",
            "format": "string"
          },
          "action": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch.RouteMatch.Action"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch.RouteMatch.Action": {
        "description": "Action refers to the route action taken by Envoy when a http route matches.",
        "type": "string",
        "enum": [
          "ANY",
          "ROUTE",
          "REDIRECT",
          "DIRECT_RESPONSE"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.ListenerMatch": {
        "description": "Conditions specified in a listener match must be met for the patch to be applied to a specific listener across all filter chains, or a specific filter chain inside the listener.",
        "type": "object",
        "properties": {
          "name": {
            "description": "Match a specific listener by its name. The listeners generated by Pilot are typically named as IP:Port.",
            "type": "string",
            "format": "string"
          },
          "portNumber": {
            "description": "The service port/gateway port to which traffic is being sent/received. If not specified, matches all listeners. Even though inbound listeners are generated for the instance/pod ports, only service ports should be used to match listeners.",
            "type": "integer"
          },
          "portName": {
            "description": "Instead of using specific port numbers, a set of ports matching a given service's port name can be selected. Matching is case insensitive. Not implemented. $hide_from_docs",
            "type": "string",
            "format": "string"
          },
          "filterChain": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ListenerMatch.FilterChainMatch"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.ListenerMatch.FilterChainMatch": {
        "description": "For listeners with multiple filter chains (e.g., inbound listeners on sidecars with permissive mTLS, gateway listeners with multiple SNI matches), the filter chain match can be used to select a specific filter chain to patch.",
        "type": "object",
        "properties": {
          "name": {
            "description": "The name assigned to the filter chain.",
            "type": "string",
            "format": "string"
          },
          "sni": {
            "description": "The SNI value used by a filter chain's match condition. This condition will evaluate to false if the filter chain has no sni match.",
            "type": "string",
            "format": "string"
          },
          "transportProtocol": {
            "description": "Applies only to SIDECAR_INBOUND context. If non-empty, a transport protocol to consider when determining a filter chain match. This value will be compared against the transport protocol of a new connection, when it's detected by the tls_inspector listener filter.",
            "type": "string",
            "format": "string"
          },
          "applicationProtocols": {
            "description": "Applies only to sidecars. If non-empty, a comma separated set of application protocols to consider when determining a filter chain match. This value will be compared against the application protocols of a new connection, when it's detected by one of the listener filters such as the http_inspector.",
            "type": "string",
            "format": "string"
          },
          "filter": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ListenerMatch.FilterMatch"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.ListenerMatch.FilterMatch": {
        "description": "Conditions to match a specific filter within a filter chain.",
        "type": "object",
        "properties": {
          "name": {
            "description": "The filter name to match on.",
            "type": "string",
            "format": "string"
          },
          "subFilter": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ListenerMatch.SubFilterMatch"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.ListenerMatch.SubFilterMatch": {
        "description": "Conditions to match a specific filter within another filter. This field is typically useful to match a HTTP filter inside the envoy.http_connection_manager network filter. This could also be applicable for thrift filters.",
        "type": "object",
        "properties": {
          "name": {
            "description": "The filter name to match on.",
            "type": "string",
            "format": "string"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.Patch": {
        "description": "Patch specifies how the selected object should be modified.",
        "type": "object",
        "properties": {
          "operation": {
            "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.Patch.Operation"
          },
          "value": {
            "description": "The JSON config of the object being patched. This will be merged using json merge semantics with the existing proto in the path.",
            "type": "object"
          }
        }
      },
      "istio.networking.v1alpha3.EnvoyFilter.Patch.Operation": {
        "description": "Operation denotes how the patch should be applied to the selected configuration.",
        "type": "string",
        "enum": [
          "INVALID",
          "MERGE",
          "ADD",
          "REMOVE",
          "INSERT_BEFORE",
          "INSERT_AFTER"
        ]
      },
      "istio.networking.v1alpha3.EnvoyFilter.EnvoyConfigObjectMatch": {
        "description": "One or more match conditions to be met before a patch is applied to the generated configuration for a given proxy.",
        "type": "object",
        "oneOf": [
          {
            "required": [
              "listener"
            ],
            "properties": {
              "context": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.PatchContext"
              },
              "proxy": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ProxyMatch"
              },
              "listener": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ListenerMatch"
              }
            }
          },
          {
            "required": [
              "routeConfiguration"
            ],
            "properties": {
              "context": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.PatchContext"
              },
              "proxy": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ProxyMatch"
              },
              "routeConfiguration": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.RouteConfigurationMatch"
              }
            }
          },
          {
            "required": [
              "cluster"
            ],
            "properties": {
              "context": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.PatchContext"
              },
              "proxy": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ProxyMatch"
              },
              "cluster": {
                "$ref": "#/components/schemas/istio.networking.v1alpha3.EnvoyFilter.ClusterMatch"
              }
            }
          }
        ]
      }
    }
  }
}