Skip to content

Commit 88cb812

Browse files
author
soloio-bot
committed
Sync Gloo Mesh APIs. Destination Branch: gloo-mesh-v2.5.x
1 parent 8ba18da commit 88cb812

File tree

28 files changed

+843
-871
lines changed

28 files changed

+843
-871
lines changed

‎api/gloo.solo.io/admin/v2/root_trust_policy.proto

+55-4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,54 @@
1+
// A RootTrustPolicy is used to designate the root of trust, including the trust domain and root
2+
// certificates used by one or more service meshes. With a RootTrustPolicy, you can set
3+
// set up an Istio root CA and use that root CA to automatically issue intermediate CA certificates
4+
// for all your workload clusters that make up your multicluster service mesh. Because all intermediate CA certificates are
5+
// derived from the same root, your workloads can securely talk to each other, even across cluster boundaries.
6+
// This approach is also referred to as federated trust.
7+
//
8+
// You have the option to fully or partially manage the Istio CA certificate lifecycle. The
9+
// option that is right for you depends on the type of environment that you have and the level
10+
// of control you want to have over the Istio CA certificate lifecycle.
11+
//
12+
// ## Examples
13+
//
14+
// The following example instructs {{% reuse "conrefs/snippets/policies/ov_fault_injection.md" %}} to
15+
// create a self-signed root CA certificate that is valid for 730 days.
16+
//
17+
// ```yaml
18+
// apiVersion: admin.gloo.solo.io/v2
19+
// kind: RootTrustPolicy
20+
// metadata:
21+
// name: root-trust-policy
22+
// namespace: gloo-mesh
23+
// spec:
24+
// config:
25+
// mgmtServerCa:
26+
// generated:
27+
// ttlDays: 730
28+
// ```
29+
//
30+
// To bring your own root CA certificate, store the root CA credentials in a Kubernetes secret. Then,
31+
// reference this secret in your RootTrustPolicy.
32+
//
33+
// ```yaml
34+
// apiVersion: admin.gloo.solo.io/v2
35+
// kind: RootTrustPolicy
36+
// metadata:
37+
// name: istio-ingressgateway
38+
// namespace: gloo-mesh
39+
// spec:
40+
// config:
41+
// mgmtServerCa:
42+
// secretRef:
43+
// name: my-root-trust-cert
44+
// namespace: gloo-mesh
45+
// ```
46+
//
47+
// {{% alert %}}
48+
// Creating a RootTrustPoliy resource triggers the renewal of Istio certificates.
49+
// If your service mesh uses sidecars, you must restart your applications
50+
// to apply the latest certificate.
51+
// {{% /alert %}}
152
syntax = "proto3";
253

354
package admin.gloo.solo.io;
@@ -14,8 +65,6 @@ option (extproto.equal_all) = true;
1465
option (extproto.hash_all) = true;
1566
option (extproto.clone_all) = true;
1667

17-
// RootTrustPolicy is used to designate the root of trust, including the trust domain and root certificates used by one or more service meshes.
18-
// A shared RootTrustPolicy is currently required to support communication between workloads and destinations running in different meshes. In the future Gloo Mesh will support cross-mesh connectivity using a Limited Trust model (where participating meshes are permitted to use separate roots of trust).
1968
message RootTrustPolicySpec {
2069

2170
// select the meshes where the root of trust will be applied.
@@ -52,10 +101,12 @@ message RootTrustPolicySpec {
52101
// Specify the source of the Root CA data which Gloo Mesh will use for the RootTrustPolicy.
53102
oneof ca_source {
54103

55-
// Generate a self-signed root certificate with the given options.
104+
// Generate a self-signed root certificate with the given options. By default, the root CA
105+
// is valid for 1 year.
56106
.tls.security.policy.gloo.solo.io.CommonCertOptions generated = 1;
57107

58-
// Name of a Kubernetes Secret in the same namespace as the RootTrustPolicy containing the root certificate authority.
108+
// The name of a Kubernetes secret in the same namespace as the RootTrustPolicy that contains the
109+
// root certificate authority.
59110
// Provided certificates must conform to a specified format, [documented here]({{< link path="/setup/prod/certs/relay/" >}}).
60111
.core.skv2.solo.io.ObjectRef secret_ref = 2;
61112

‎api/gloo.solo.io/apimanagement/v2/api_doc.proto

+6-19
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
// The ApiDoc type is used to represent different types of API schema specification languages:
55
// - OpenAPI
66
// - gRPC
7-
// - GraphQL
87
syntax = "proto3";
98

109
package apimanagement.gloo.solo.io;
@@ -46,6 +45,8 @@ message ApiDocSpec {
4645
// The gRPC schema specification language. Specify only one schema type.
4746
GrpcSchema grpc = 2;
4847

48+
// <b>Unsupported</b>: The GraphQL integration is no longer supported.
49+
//
4950
// The graphQL schema specification language. Specify only one schema type.
5051
GraphQLSchema graphql = 3;
5152
}
@@ -82,17 +83,9 @@ message ApiDocSpec {
8283
string inline_string = 1;
8384
}
8485

85-
// A complete gRPC schema describing the API.
86+
// <b>Unsupported</b>: The GraphQL integration is no longer supported.
8687
//
87-
// **Example**: In this gRPC example for a basic user service app,
88-
// the base64-encoded descriptor includes a set of fields that are defined
89-
// for various queries, such as `UserSearch` and `UserByCountry`. For detailed
90-
// information about the settings in this example, see
91-
// [gRPC schema](https://docs.solo.io/gloo-mesh-gateway/latest/graphql/resolvers/resolved/resolver_grpc/)
92-
// in the GraphQL integration documentation.
93-
// ```yaml
94-
// {{% readfile file="static/content/examples/generated/int/graphql_routes/cluster-1/api-doc_bookinfo_grpc-schema.yaml" %}}
95-
// ```
88+
// A complete gRPC schema describing the API.
9689
message GrpcSchema {
9790
// Protobuf descriptors that represent the gRPC services provided by your API, encoded in base64.
9891
// For more information, see the
@@ -101,19 +94,13 @@ message ApiDocSpec {
10194

10295
}
10396

97+
// <b>Unsupported</b>: The GraphQL integration is no longer supported.
98+
//
10499
// Provide a schema definition in GraphQL SDL format.
105100
// The GraphQL schema also has logging options for logging sensitive
106101
// request-related information, and schema extension configuration such as
107102
// custom type definitions. For more information about the different schema features,
108103
// see the [GraphQL documentation](https://graphql.org/learn/schema/).
109-
//
110-
// **Example**: In this GraphQL example for the Bookinfo sample app, a query type and object
111-
// types are defined. For detailed information about the settings in this example, see
112-
// [Example GraphQL ApiDoc](https://docs.solo.io/gloo-mesh-gateway/latest/graphql/apidoc/#example-graphql-apidoc)
113-
// in the GraphQL integration documentation.
114-
// ```yaml
115-
// {{% readfile file="static/content/examples/generated/int/graphql_proxied_introspection/cluster-1/api-doc_bookinfo_music-schema.yaml" %}}
116-
// ```
117104
message GraphQLSchema {
118105
// Required: The GraphQL schema definition. Root-level query and mutation
119106
// types are supported, and you must define at least a query type.

‎api/gloo.solo.io/internal/insights/v2alpha1/insights.proto

+4-7
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,11 @@ message Insight {
101101
SYS0012Data SYS0012 = 25;
102102
SYS0014Data SYS0014 = 27;
103103
SYS0015Data SYS0015 = 28;
104-
SYS0019Data SYS0019 = 29; // Adding so UI works for mock - might change later
105104
SYS0020Data SYS0020 = 30;
106105
SYS0025Data SYS0025 = 31;
107106
}
107+
108+
reserved 29;
108109
}
109110

110111
// Agent Deployent Reference
@@ -229,17 +230,13 @@ message Insight {
229230
int32 value = 1;
230231
}
231232

232-
// Adding so UI works for mock - might change later
233-
message SYS0019Data {
234-
string cilium_version = 1;
235-
}
236-
237233
// resource counts
238234
message SYS0020Data {
239235
int32 istio_resources = 1;
240-
int32 cilium_resources = 2;
241236
int32 k8s_resources = 3;
242237
int32 gateway_resources = 4;
243238
int32 solo_resources = 5;
239+
240+
reserved 2;
244241
}
245242
}

‎api/gloo.solo.io/networking/v2/virtual_gateway.proto

+4-2
Original file line numberDiff line numberDiff line change
@@ -230,8 +230,10 @@ message VirtualGatewaySpec {
230230
message HTTPServer {
231231

232232
}
233-
234-
// $hide_from_docs TODO: TCPServer
233+
234+
// Serve TCP routes for RouteTables that select this gateway.
235+
// Make sure to open a TCP port on the backing Istio ingress gateway,
236+
// which might require upgrading your IstioLifecycleManager or Helm installation.
235237
message TCPServer {
236238

237239
}

‎api/gloo.solo.io/policy/v2/resilience/adaptive_request_concurrency_policy.proto

-1
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ option (extproto.clone_all) = true;
5151
message AdaptiveRequestConcurrencyPolicySpec {
5252

5353
// Destinations to apply the concurrency limit to.
54-
// Note that external services are not supported as destinations with this policy.
5554
// If empty, the policy applies to all destinations in the workspace.
5655
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 1;
5756

‎api/gloo.solo.io/policy/v2/resilience/failover_policy.proto

-4
Original file line numberDiff line numberDiff line change
@@ -69,10 +69,6 @@ message FailoverPolicySpec {
6969

7070
// Select the destinations to apply the policy to by using labels.
7171
// If empty, the policy applies to all destinations in the workspace.
72-
// {{< alert context="info" >}}
73-
// The destinations can be Kubernetes services or virtual destinations.
74-
// Note that external services are not supported as destinations with this policy.
75-
// {{< /alert >}}
7672
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 1;
7773

7874
// The details of the failover policy to apply to the selected virtual destinations.

‎api/gloo.solo.io/policy/v2/resilience/listener_connection_policy.proto

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ option (extproto.clone_all) = true;
1818
// ListenerConnectionPolicy is used to set configuration for gateway listeners.
1919
//
2020
// ```
21-
// apiVersion: trafficcontrol.policy.gloo.solo.io/v2
21+
// apiVersion: resilience.policy.gloo.solo.io/v2
2222
// kind: ListenerConnectionPolicy
2323
// metadata:
2424
// name: my-policy

‎api/gloo.solo.io/policy/v2/resilience/outlier_detection_policy.proto

+2-5
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,8 @@ message OutlierDetectionPolicySpec {
4343
//
4444
// </br>**Implementation notes**:<ul>
4545
// <li>If empty, the policy applies to all destinations in the workspace.</li>
46-
// <li>The outlier detection policy currently supports selecting Gloo virtual destinations.
47-
// Selecting Kubernetes services is not supported. To select a Gloo external service,
48-
// the external service must refer to a service that is outside the service mesh
49-
// but within the same cluster environment. Selecting Gloo external services that
50-
// refer to a service outside the cluster is not supported.</li></ul>
46+
// <li>This policy currently supports selecting Gloo virtual destinations or external services.
47+
// Selecting Kubernetes services is not supported.</li></ul>
5148
//
5249
// **Configuration constraints**: `applyToDestinations.kind` must equal either `VIRTUAL_DESTINATION` or `EXTERNAL_SERVICE`.
5350
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 1;

‎api/gloo.solo.io/policy/v2/security/ext_auth_policy.proto

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ message ExtAuthPolicySpec {
5656
// Destinations to apply the policy to.
5757
//
5858
// </br>**Implementation notes**:
59-
// <li>Only Kubernetes services can be specified. Virtual destinations or external services are not supported.</li>
59+
// <li>{{< reuse "conrefs/snippets/field-desc/dest-no-vdest.md" >}}</li>
6060
// <li>If empty and `applyToRoutes` is unset, the policy applies to all destinations in the workspace.</li>
6161
// <li>If empty and `applyToRoutes` is set, the policy does not apply to any destinations in the workspace.</li></ul>
6262
//

‎api/gloo.solo.io/policy/v2/security/jwt_policy.proto

+2-1
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,8 @@ message JWTPolicySpec {
105105
// If omitted and the policy selects a destination, the policy does not apply to any routes.
106106
repeated .common.gloo.solo.io.RouteSelector apply_to_routes = 1;
107107

108-
// Select the destinations where the policy will be applied. Only Kubernetes services are supported.
108+
// Select the destinations where the policy will be applied.
109+
// {{< reuse "conrefs/snippets/field-desc/dest-no-vdest.md" >}}
109110
// By default if omitted, the policy does not apply to any destinations.
110111
// If empty (`{}`), the policy applies to all destinations in the workspace.
111112
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 3;

‎api/gloo.solo.io/policy/v2/trafficcontrol/ratelimit_policy.proto

+1-2
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@ message RateLimitPolicySpec {
2929
repeated .common.gloo.solo.io.RouteSelector apply_to_routes = 1;
3030

3131
// Select the destinations where the policy will be applied.
32-
// Note that rate limit outputs are only translated for destinations that are Kubernetes services.
33-
// External services and virtual destinations are not supported as destinations with this policy.
32+
// {{< reuse "conrefs/snippets/field-desc/dest-no-vdest.md" >}}
3433
// If empty, the rate limit policy applies to all destinations in the workspace.
3534
// If the destination selector is empty but the route selector is set, no rate limits are applied on destinations, only on routes.
3635
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 2;

‎client-go/admin.gloo.solo.io/v2/root_trust_policy.pb.go

+56-4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,55 @@
1+
// A RootTrustPolicy is used to designate the root of trust, including the trust domain and root
2+
// certificates used by one or more service meshes. With a RootTrustPolicy, you can set
3+
// set up an Istio root CA and use that root CA to automatically issue intermediate CA certificates
4+
// for all your workload clusters that make up your multicluster service mesh. Because all intermediate CA certificates are
5+
// derived from the same root, your workloads can securely talk to each other, even across cluster boundaries.
6+
// This approach is also referred to as federated trust.
7+
//
8+
// You have the option to fully or partially manage the Istio CA certificate lifecycle. The
9+
// option that is right for you depends on the type of environment that you have and the level
10+
// of control you want to have over the Istio CA certificate lifecycle.
11+
//
12+
// ## Examples
13+
//
14+
// The following example instructs {{% reuse "conrefs/snippets/policies/ov_fault_injection.md" %}} to
15+
// create a self-signed root CA certificate that is valid for 730 days.
16+
//
17+
// ```yaml
18+
// apiVersion: admin.gloo.solo.io/v2
19+
// kind: RootTrustPolicy
20+
// metadata:
21+
// name: root-trust-policy
22+
// namespace: gloo-mesh
23+
// spec:
24+
// config:
25+
// mgmtServerCa:
26+
// generated:
27+
// ttlDays: 730
28+
// ```
29+
//
30+
// To bring your own root CA certificate, store the root CA credentials in a Kubernetes secret. Then,
31+
// reference this secret in your RootTrustPolicy.
32+
//
33+
// ```yaml
34+
// apiVersion: admin.gloo.solo.io/v2
35+
// kind: RootTrustPolicy
36+
// metadata:
37+
// name: istio-ingressgateway
38+
// namespace: gloo-mesh
39+
// spec:
40+
// config:
41+
// mgmtServerCa:
42+
// secretRef:
43+
// name: my-root-trust-cert
44+
// namespace: gloo-mesh
45+
// ```
46+
//
47+
// {{% alert %}}
48+
// Creating a RootTrustPoliy resource triggers the renewal of Istio certificates.
49+
// If your service mesh uses sidecars, you must restart your applications
50+
// to apply the latest certificate.
51+
// {{% /alert %}}
52+
153
// Code generated by protoc-gen-go. DO NOT EDIT.
254
// versions:
355
// protoc-gen-go v1.26.0
@@ -26,8 +78,6 @@ const (
2678
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
2779
)
2880

29-
// RootTrustPolicy is used to designate the root of trust, including the trust domain and root certificates used by one or more service meshes.
30-
// A shared RootTrustPolicy is currently required to support communication between workloads and destinations running in different meshes. In the future Gloo Mesh will support cross-mesh connectivity using a Limited Trust model (where participating meshes are permitted to use separate roots of trust).
3181
type RootTrustPolicySpec struct {
3282
state protoimpl.MessageState
3383
sizeCache protoimpl.SizeCache
@@ -337,12 +387,14 @@ type isRootTrustPolicySpec_Config_MgmtServerCertificateAuthority_CaSource interf
337387
}
338388

339389
type RootTrustPolicySpec_Config_MgmtServerCertificateAuthority_Generated struct {
340-
// Generate a self-signed root certificate with the given options.
390+
// Generate a self-signed root certificate with the given options. By default, the root CA
391+
// is valid for 1 year.
341392
Generated *tls.CommonCertOptions `protobuf:"bytes,1,opt,name=generated,proto3,oneof"`
342393
}
343394

344395
type RootTrustPolicySpec_Config_MgmtServerCertificateAuthority_SecretRef struct {
345-
// Name of a Kubernetes Secret in the same namespace as the RootTrustPolicy containing the root certificate authority.
396+
// The name of a Kubernetes secret in the same namespace as the RootTrustPolicy that contains the
397+
// root certificate authority.
346398
// Provided certificates must conform to a specified format, [documented here]({{< link path="/setup/prod/certs/relay/" >}}).
347399
SecretRef *v1.ObjectRef `protobuf:"bytes,2,opt,name=secret_ref,json=secretRef,proto3,oneof"`
348400
}

‎client-go/apimanagement.gloo.solo.io/v2/api_doc.pb.go

+6-19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)