Skip to content

Commit ed6aa88

Browse files
author
soloio-bot
committed
Sync Gloo Mesh APIs. Destination Branch: gloo-mesh-v2.6.x
1 parent aac2ed1 commit ed6aa88

File tree

74 files changed

+9686
-3463
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+9686
-3463
lines changed

‎api/gloo.solo.io/admin/v2/root_trust_policy.proto

+55-4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,54 @@
1+
// A RootTrustPolicy is used to designate the root of trust, including the trust domain and root
2+
// certificates used by one or more service meshes. With a RootTrustPolicy, you can set
3+
// set up an Istio root CA and use that root CA to automatically issue intermediate CA certificates
4+
// for all your workload clusters that make up your multicluster service mesh. Because all intermediate CA certificates are
5+
// derived from the same root, your workloads can securely talk to each other, even across cluster boundaries.
6+
// This approach is also referred to as federated trust.
7+
//
8+
// You have the option to fully or partially manage the Istio CA certificate lifecycle. The
9+
// option that is right for you depends on the type of environment that you have and the level
10+
// of control you want to have over the Istio CA certificate lifecycle.
11+
//
12+
// ## Examples
13+
//
14+
// The following example instructs {{% reuse "conrefs/snippets/policies/ov_fault_injection.md" %}} to
15+
// create a self-signed root CA certificate that is valid for 730 days.
16+
//
17+
// ```yaml
18+
// apiVersion: admin.gloo.solo.io/v2
19+
// kind: RootTrustPolicy
20+
// metadata:
21+
// name: root-trust-policy
22+
// namespace: gloo-mesh
23+
// spec:
24+
// config:
25+
// mgmtServerCa:
26+
// generated:
27+
// ttlDays: 730
28+
// ```
29+
//
30+
// To bring your own root CA certificate, store the root CA credentials in a Kubernetes secret. Then,
31+
// reference this secret in your RootTrustPolicy.
32+
//
33+
// ```yaml
34+
// apiVersion: admin.gloo.solo.io/v2
35+
// kind: RootTrustPolicy
36+
// metadata:
37+
// name: istio-ingressgateway
38+
// namespace: gloo-mesh
39+
// spec:
40+
// config:
41+
// mgmtServerCa:
42+
// secretRef:
43+
// name: my-root-trust-cert
44+
// namespace: gloo-mesh
45+
// ```
46+
//
47+
// {{% alert %}}
48+
// Creating a RootTrustPoliy resource triggers the renewal of Istio certificates.
49+
// If your service mesh uses sidecars, you must restart your applications
50+
// to apply the latest certificate.
51+
// {{% /alert %}}
152
syntax = "proto3";
253

354
package admin.gloo.solo.io;
@@ -14,8 +65,6 @@ option (extproto.equal_all) = true;
1465
option (extproto.hash_all) = true;
1566
option (extproto.clone_all) = true;
1667

17-
// RootTrustPolicy is used to designate the root of trust, including the trust domain and root certificates used by one or more service meshes.
18-
// A shared RootTrustPolicy is currently required to support communication between workloads and destinations running in different meshes. In the future Gloo Mesh will support cross-mesh connectivity using a Limited Trust model (where participating meshes are permitted to use separate roots of trust).
1968
message RootTrustPolicySpec {
2069

2170
// select the meshes where the root of trust will be applied.
@@ -52,10 +101,12 @@ message RootTrustPolicySpec {
52101
// Specify the source of the Root CA data which Gloo Mesh will use for the RootTrustPolicy.
53102
oneof ca_source {
54103

55-
// Generate a self-signed root certificate with the given options.
104+
// Generate a self-signed root certificate with the given options. By default, the root CA
105+
// is valid for 1 year.
56106
.tls.security.policy.gloo.solo.io.CommonCertOptions generated = 1;
57107

58-
// Name of a Kubernetes Secret in the same namespace as the RootTrustPolicy containing the root certificate authority.
108+
// The name of a Kubernetes secret in the same namespace as the RootTrustPolicy that contains the
109+
// root certificate authority.
59110
// Provided certificates must conform to a specified format, [documented here]({{< link path="/setup/prod/certs/relay/" >}}).
60111
.core.skv2.solo.io.ObjectRef secret_ref = 2;
61112

‎api/gloo.solo.io/apimanagement/v2/api_doc.proto

+6-19
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
// The ApiDoc type is used to represent different types of API schema specification languages:
55
// - OpenAPI
66
// - gRPC
7-
// - GraphQL
87
syntax = "proto3";
98

109
package apimanagement.gloo.solo.io;
@@ -45,6 +44,8 @@ message ApiDocSpec {
4544
// The gRPC schema specification language. Specify only one schema type.
4645
GrpcSchema grpc = 2;
4746

47+
// <b>Unsupported</b>: The GraphQL integration is no longer supported.
48+
//
4849
// The graphQL schema specification language. Specify only one schema type.
4950
GraphQLSchema graphql = 3;
5051
}
@@ -81,17 +82,9 @@ message ApiDocSpec {
8182
string inline_string = 1;
8283
}
8384

84-
// A complete gRPC schema describing the API.
85+
// <b>Unsupported</b>: The GraphQL integration is no longer supported.
8586
//
86-
// **Example**: In this gRPC example for a basic user service app,
87-
// the base64-encoded descriptor includes a set of fields that are defined
88-
// for various queries, such as `UserSearch` and `UserByCountry`. For detailed
89-
// information about the settings in this example, see
90-
// [gRPC schema](https://docs.solo.io/gloo-mesh-gateway/latest/graphql/resolvers/resolved/resolver_grpc/)
91-
// in the GraphQL integration documentation.
92-
// ```yaml
93-
// {{% readfile file="static/content/examples/generated/int/graphql_routes/cluster-1/api-doc_bookinfo_grpc-schema.yaml" %}}
94-
// ```
87+
// A complete gRPC schema describing the API.
9588
message GrpcSchema {
9689
// Protobuf descriptors that represent the gRPC services provided by your API, encoded in base64.
9790
// For more information, see the
@@ -100,19 +93,13 @@ message ApiDocSpec {
10093

10194
}
10295

96+
// <b>Unsupported</b>: The GraphQL integration is no longer supported.
97+
//
10398
// Provide a schema definition in GraphQL SDL format.
10499
// The GraphQL schema also has logging options for logging sensitive
105100
// request-related information, and schema extension configuration such as
106101
// custom type definitions. For more information about the different schema features,
107102
// see the [GraphQL documentation](https://graphql.org/learn/schema/).
108-
//
109-
// **Example**: In this GraphQL example for the Bookinfo sample app, a query type and object
110-
// types are defined. For detailed information about the settings in this example, see
111-
// [Example GraphQL ApiDoc](https://docs.solo.io/gloo-mesh-gateway/latest/graphql/apidoc/#example-graphql-apidoc)
112-
// in the GraphQL integration documentation.
113-
// ```yaml
114-
// {{% readfile file="static/content/examples/generated/int/graphql_proxied_introspection/cluster-1/api-doc_bookinfo_music-schema.yaml" %}}
115-
// ```
116103
message GraphQLSchema {
117104
// Required: The GraphQL schema definition. Root-level query and mutation
118105
// types are supported, and you must define at least a query type.

‎api/gloo.solo.io/internal/insights/v2alpha1/insights.proto

-7
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,6 @@ message Insight {
101101
SYS0012Data SYS0012 = 25;
102102
SYS0014Data SYS0014 = 27;
103103
SYS0015Data SYS0015 = 28;
104-
SYS0019Data SYS0019 = 29; // Adding so UI works for mock - might change later
105104
SYS0020Data SYS0020 = 30;
106105
SYS0025Data SYS0025 = 31;
107106
}
@@ -229,15 +228,9 @@ message Insight {
229228
int32 value = 1;
230229
}
231230

232-
// Adding so UI works for mock - might change later
233-
message SYS0019Data {
234-
string cilium_version = 1;
235-
}
236-
237231
// resource counts
238232
message SYS0020Data {
239233
int32 istio_resources = 1;
240-
int32 cilium_resources = 2;
241234
int32 k8s_resources = 3;
242235
int32 gateway_resources = 4;
243236
int32 solo_resources = 5;

‎api/gloo.solo.io/internal/v2alpha1/virtual_service_backup.proto

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
syntax = "proto3";
2+
package internal.gloo.solo.io;
3+
4+
import "istio.io/api/networking/v1beta1/virtual_service.proto";
5+
import "github.com/solo-io/solo-apis/api/gloo.solo.io/common/v2/references.proto";
6+
7+
option go_package = "github.com/solo-io/solo-apis/client-go/internal.gloo.solo.io/v2alpha1";
8+
9+
message VirtualServiceBackupSpec {
10+
// The VirtualService spec that is being backed up
11+
// $hide_from_docs
12+
istio.networking.v1beta1.VirtualService spec = 1;
13+
}

‎api/gloo.solo.io/networking/v2/virtual_gateway.proto

+4-2
Original file line numberDiff line numberDiff line change
@@ -249,8 +249,10 @@ message VirtualGatewaySpec {
249249
message HTTPServer {
250250

251251
}
252-
253-
// $hide_from_docs TODO: TCPServer
252+
253+
// Serve TCP routes for RouteTables that select this gateway.
254+
// Make sure to open a TCP port on the backing Istio ingress gateway,
255+
// which might require upgrading your IstioLifecycleManager or Helm installation.
254256
message TCPServer {
255257

256258
}

‎api/gloo.solo.io/networking/v2alpha1/progressive_delivery.proto

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
syntax = "proto3";
2+
package networking.gloo.solo.io;
3+
4+
import "extproto/ext.proto";
5+
import "istio.io/api/networking/v1beta1/virtual_service.proto";
6+
import "github.com/solo-io/solo-apis/api/gloo.solo.io/common/v2/status.proto";
7+
import "github.com/solo-io/solo-apis/api/gloo.solo.io/common/v2/references.proto";
8+
9+
option go_package = "github.com/solo-io/solo-apis/client-go/networking.gloo.solo.io/v2alpha1";
10+
11+
option (extproto.equal_all) = true;
12+
option (extproto.clone_all) = true;
13+
option (extproto.hash_all) = true;
14+
15+
// $hide_from_docs
16+
message ProgressiveDeliverySpec {
17+
18+
// +kubebuilder:validation:Required
19+
.common.gloo.solo.io.ObjectReference route_table_ref = 1;
20+
21+
// +kubebuilder:validation:MinItems=1
22+
repeated VirtualServiceRoute virtual_service_patch = 2;
23+
24+
// $hide_from_docs
25+
message VirtualServiceRoute {
26+
string name = 1;
27+
28+
// +kubebuilder:validation:MinItems=1
29+
// +kubebuilder:validation:Required
30+
repeated HttpRouteDestination route = 2;
31+
}
32+
33+
// $hide_from_docs
34+
message HttpRouteDestination {
35+
// +kubebuilder:validation:Required
36+
Destination destination = 1;
37+
38+
// +kubebuilder:default=0
39+
int32 weight = 2;
40+
}
41+
}
42+
43+
// $hide_from_docs
44+
message ProgressiveDeliveryStatus {
45+
// The state of the applied resource
46+
.common.gloo.solo.io.Status common = 1;
47+
48+
// Any Virtual Service that was successfully patched
49+
repeated .common.gloo.solo.io.ObjectReference patchedVirtualServices = 2;
50+
51+
// Any Virtual Service that failed to patch
52+
repeated .common.gloo.solo.io.ObjectReference failedToPatchVirtualServices = 3;
53+
}
54+
55+
// $hide_from_docs
56+
message Destination {
57+
// The name of a service from the service registry. Service
58+
// names are looked up from the platform's service registry (e.g.,
59+
// Kubernetes services, Consul services, etc.) and from the hosts
60+
// declared by ServiceEntry.
61+
// +kubebuilder:validation:Required
62+
string host = 1;
63+
64+
// Either the name or labels of a subset within the service, only one can be set.
65+
// +kubebuilder:validation:Required
66+
// +kubebuilder:validation:XValidation:rule="has(self.name) ? !has(self.labels) : has(self.labels)",message="either name or labels must be set, but not both."
67+
SubsetSelector subset = 2;
68+
69+
// Specifies the port on the host that is being addressed.
70+
istio.networking.v1beta1.PortSelector port = 3;
71+
}
72+
73+
// $hide_from_docs
74+
message SubsetSelector {
75+
string name = 1;
76+
map<string, string> labels = 2;
77+
}

‎api/gloo.solo.io/policy/v2/resilience/adaptive_request_concurrency_policy.proto

-1
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@ option (extproto.clone_all) = true;
5151
message AdaptiveRequestConcurrencyPolicySpec {
5252

5353
// Destinations to apply the concurrency limit to.
54-
// Note that external services are not supported as destinations with this policy.
5554
// If empty, the policy applies to all destinations in the workspace.
5655
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 1;
5756

‎api/gloo.solo.io/policy/v2/resilience/failover_policy.proto

-4
Original file line numberDiff line numberDiff line change
@@ -69,10 +69,6 @@ message FailoverPolicySpec {
6969

7070
// Select the destinations to apply the policy to by using labels.
7171
// If empty, the policy applies to all destinations in the workspace.
72-
// {{< alert context="info" >}}
73-
// The destinations can be Kubernetes services or virtual destinations.
74-
// Note that external services are not supported as destinations with this policy.
75-
// {{< /alert >}}
7672
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 1;
7773

7874
// The details of the failover policy to apply to the selected virtual destinations.

‎api/gloo.solo.io/policy/v2/resilience/listener_connection_policy.proto

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ option (extproto.clone_all) = true;
1818
// ListenerConnectionPolicy is used to set configuration for gateway listeners.
1919
//
2020
// ```
21-
// apiVersion: trafficcontrol.policy.gloo.solo.io/v2
21+
// apiVersion: resilience.policy.gloo.solo.io/v2
2222
// kind: ListenerConnectionPolicy
2323
// metadata:
2424
// name: my-policy

‎api/gloo.solo.io/policy/v2/resilience/outlier_detection_policy.proto

+2-5
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,8 @@ message OutlierDetectionPolicySpec {
4343
//
4444
// </br>**Implementation notes**:<ul>
4545
// <li>If empty, the policy applies to all destinations in the workspace.</li>
46-
// <li>The outlier detection policy currently supports selecting Gloo virtual destinations.
47-
// Selecting Kubernetes services is not supported. To select a Gloo external service,
48-
// the external service must refer to a service that is outside the service mesh
49-
// but within the same cluster environment. Selecting Gloo external services that
50-
// refer to a service outside the cluster is not supported.</li></ul>
46+
// <li>This policy currently supports selecting Gloo virtual destinations or external services.
47+
// Selecting Kubernetes services is not supported.</li></ul>
5148
//
5249
// **Configuration constraints**: `applyToDestinations.kind` must equal either `VIRTUAL_DESTINATION` or `EXTERNAL_SERVICE`.
5350
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 1;

‎api/gloo.solo.io/policy/v2/security/ext_auth_policy.proto

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ message ExtAuthPolicySpec {
5555
// Destinations to apply the policy to.
5656
//
5757
// </br>**Implementation notes**:
58-
// <li>Only Kubernetes services can be specified. Virtual destinations or external services are not supported.</li>
58+
// <li>{{< reuse "conrefs/snippets/field-desc/dest-no-vdest.md" >}}</li>
5959
// <li>If empty and `applyToRoutes` is unset, the policy applies to all destinations in the workspace.</li>
6060
// <li>If empty and `applyToRoutes` is set, the policy does not apply to any destinations in the workspace.</li></ul>
6161
//

‎api/gloo.solo.io/policy/v2/security/jwt_policy.proto

+2-1
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,8 @@ message JWTPolicySpec {
104104
// If omitted and the policy selects a destination, the policy does not apply to any routes.
105105
repeated .common.gloo.solo.io.RouteSelector apply_to_routes = 1;
106106

107-
// Select the destinations where the policy will be applied. Only Kubernetes services are supported.
107+
// Select the destinations where the policy will be applied.
108+
// {{< reuse "conrefs/snippets/field-desc/dest-no-vdest.md" >}}
108109
// By default if omitted, the policy does not apply to any destinations.
109110
// If empty (`{}`), the policy applies to all destinations in the workspace.
110111
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 3;

‎api/gloo.solo.io/policy/v2/trafficcontrol/ratelimit_policy.proto

+1-2
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,7 @@ message RateLimitPolicySpec {
2828
repeated .common.gloo.solo.io.RouteSelector apply_to_routes = 1;
2929

3030
// Select the destinations where the policy will be applied.
31-
// Note that rate limit outputs are only translated for destinations that are Kubernetes services.
32-
// External services and virtual destinations are not supported as destinations with this policy.
31+
// {{< reuse "conrefs/snippets/field-desc/dest-no-vdest.md" >}}
3332
// If empty, the rate limit policy applies to all destinations in the workspace.
3433
// If the destination selector is empty but the route selector is set, no rate limits are applied on destinations, only on routes.
3534
repeated .common.gloo.solo.io.DestinationSelector apply_to_destinations = 2;

0 commit comments

Comments
 (0)