Skip to content

Commit 6fe558c

Browse files
nicholasklemnicholasklem
authored
Update Envoy Gateway schemas to v1.6.0 (#745)
1 parent e077ff8 commit 6fe558c

8 files changed

+1646
-121
lines changed

‎gateway.envoyproxy.io/backend_v1alpha1.json‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,14 @@
145145
"tls": {
146146
"description": "TLS defines the TLS settings for the backend.\nIf TLS is specified here and a BackendTLSPolicy is also configured for the backend, the final TLS settings will\nbe a merge of both configurations. In case of overlapping fields, the values defined in the BackendTLSPolicy will\ntake precedence.",
147147
"properties": {
148+
"alpnProtocols": {
149+
"description": "ALPNProtocols supplies the list of ALPN protocols that should be\nexposed by the listener or used by the proxy to connect to the backend.\nDefaults:\n1. HTTPS Routes: h2 and http/1.1 are enabled in listener context.\n2. Other Routes: ALPN is disabled.\n3. Backends: proxy uses the appropriate ALPN options for the backend protocol.\nWhen an empty list is provided, the ALPN TLS extension is disabled.\n\nDefaults to [h2, http/1.1] if not specified.\n\nTypical Supported values are:\n- http/1.0\n- http/1.1\n- h2",
150+
"items": {
151+
"description": "ALPNProtocol specifies the protocol to be negotiated using ALPN",
152+
"type": "string"
153+
},
154+
"type": "array"
155+
},
148156
"caCertificateRefs": {
149157
"description": "CACertificateRefs contains one or more references to Kubernetes objects that\ncontain TLS certificates of the Certificate Authorities that can be used\nas a trust anchor to validate the certificates presented by the backend.\n\nA single reference to a Kubernetes ConfigMap or a Kubernetes Secret,\nwith the CA certificate in a key named `ca.crt` is currently supported.\n\nIf CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be\nspecified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,\nnot both.",
150158
"items": {
@@ -181,11 +189,99 @@
181189
"maxItems": 8,
182190
"type": "array"
183191
},
192+
"ciphers": {
193+
"description": "Ciphers specifies the set of cipher suites supported when\nnegotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.\nIn non-FIPS Envoy Proxy builds the default cipher list is:\n- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\n- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\n- ECDHE-ECDSA-AES256-GCM-SHA384\n- ECDHE-RSA-AES256-GCM-SHA384\nIn builds using BoringSSL FIPS the default cipher list is:\n- ECDHE-ECDSA-AES128-GCM-SHA256\n- ECDHE-RSA-AES128-GCM-SHA256\n- ECDHE-ECDSA-AES256-GCM-SHA384\n- ECDHE-RSA-AES256-GCM-SHA384",
194+
"items": {
195+
"type": "string"
196+
},
197+
"type": "array"
198+
},
199+
"clientCertificateRef": {
200+
"description": "ClientCertificateRef defines the reference to a Kubernetes Secret that contains\nthe client certificate and private key for Envoy to use when connecting to\nbackend services and external services, such as ExtAuth, ALS, OpenTelemetry, etc.\nThis secret should be located within the same namespace as the Envoy proxy resource that references it.",
201+
"properties": {
202+
"group": {
203+
"default": "",
204+
"description": "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.",
205+
"maxLength": 253,
206+
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
207+
"type": "string"
208+
},
209+
"kind": {
210+
"default": "Secret",
211+
"description": "Kind is kind of the referent. For example \"Secret\".",
212+
"maxLength": 63,
213+
"minLength": 1,
214+
"pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
215+
"type": "string"
216+
},
217+
"name": {
218+
"description": "Name is the name of the referent.",
219+
"maxLength": 253,
220+
"minLength": 1,
221+
"type": "string"
222+
},
223+
"namespace": {
224+
"description": "Namespace is the namespace of the referenced object. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core",
225+
"maxLength": 63,
226+
"minLength": 1,
227+
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
228+
"type": "string"
229+
}
230+
},
231+
"required": [
232+
"name"
233+
],
234+
"type": "object",
235+
"additionalProperties": false
236+
},
237+
"ecdhCurves": {
238+
"description": "ECDHCurves specifies the set of supported ECDH curves.\nIn non-FIPS Envoy Proxy builds the default curves are:\n- X25519\n- P-256\nIn builds using BoringSSL FIPS the default curve is:\n- P-256",
239+
"items": {
240+
"type": "string"
241+
},
242+
"type": "array"
243+
},
184244
"insecureSkipVerify": {
185245
"default": false,
186246
"description": "InsecureSkipVerify indicates whether the upstream's certificate verification\nshould be skipped. Defaults to \"false\".",
187247
"type": "boolean"
188248
},
249+
"maxVersion": {
250+
"description": "Max specifies the maximal TLS protocol version to allow\nThe default is TLS 1.3 if this is not specified.",
251+
"enum": [
252+
"Auto",
253+
"1.0",
254+
"1.1",
255+
"1.2",
256+
"1.3"
257+
],
258+
"type": "string"
259+
},
260+
"minVersion": {
261+
"description": "Min specifies the minimal TLS protocol version to allow.\nThe default is TLS 1.2 if this is not specified.",
262+
"enum": [
263+
"Auto",
264+
"1.0",
265+
"1.1",
266+
"1.2",
267+
"1.3"
268+
],
269+
"type": "string"
270+
},
271+
"signatureAlgorithms": {
272+
"description": "SignatureAlgorithms specifies which signature algorithms the listener should\nsupport.",
273+
"items": {
274+
"type": "string"
275+
},
276+
"type": "array"
277+
},
278+
"sni": {
279+
"description": "SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.\n\nEnvoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:\n1. Backend resources that do not set SNI, or\n2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them\n\nWhen a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence\nover this value.",
280+
"maxLength": 253,
281+
"minLength": 1,
282+
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
283+
"type": "string"
284+
},
189285
"wellKnownCACertificates": {
190286
"description": "WellKnownCACertificates specifies whether system CA certificates may be used in\nthe TLS handshake between the gateway and backend pod.\n\nIf WellKnownCACertificates is unspecified or empty (\"\"), then CACertificateRefs\nmust be specified with at least one entry for a valid configuration. Only one of\nCACertificateRefs or WellKnownCACertificates may be specified, not both.",
191287
"enum": [
@@ -203,6 +299,14 @@
203299
{
204300
"message": "must not contain either CACertificateRefs or WellKnownCACertificates when InsecureSkipVerify is enabled",
205301
"rule": "!((has(self.insecureSkipVerify) && self.insecureSkipVerify) && ((has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates != \"\")))"
302+
},
303+
{
304+
"message": "setting ciphers has no effect if the minimum possible TLS version is 1.3",
305+
"rule": "has(self.minVersion) && self.minVersion == '1.3' ? !has(self.ciphers) : true"
306+
},
307+
{
308+
"message": "minVersion must be smaller or equal to maxVersion",
309+
"rule": "has(self.minVersion) && has(self.maxVersion) ? {\"Auto\":0,\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4}[self.minVersion] <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : true"
206310
}
207311
],
208312
"additionalProperties": false

0 commit comments

Comments
 (0)