gateway.envoyproxy.io_backends.yaml

{{- if .Values.crds.envoyGateway.enabled }}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.20.1
  name: backends.gateway.envoyproxy.io
spec:
  group: gateway.envoyproxy.io
  names:
    categories:
    - envoy-gateway
    kind: Backend
    listKind: BackendList
    plural: backends
    shortNames:
    - be
    singular: backend
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.conditions[?(@.type=="Accepted")].reason
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          Backend allows the user to configure the endpoints of a backend and
          the behavior of the connection from Envoy Proxy to the backend.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec defines the desired state of Backend.
            properties:
              appProtocols:
                description: AppProtocols defines the application protocols to be
                  supported when connecting to the backend.
                items:
                  description: AppProtocolType defines various backend applications
                    protocols supported by Envoy Gateway
                  enum:
                  - gateway.envoyproxy.io/h2c
                  - gateway.envoyproxy.io/ws
                  - gateway.envoyproxy.io/wss
                  type: string
                type: array
              endpoints:
                description: Endpoints defines the endpoints to be used when connecting
                  to the backend.
                items:
                  description: |-
                    BackendEndpoint describes a backend endpoint, which can be either a fully-qualified domain name, IP address or unix domain socket
                    corresponding to Envoy's Address: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-address
                  properties:
                    fqdn:
                      description: FQDN defines a FQDN endpoint
                      properties:
                        hostname:
                          description: Hostname defines the FQDN hostname of the backend
                            endpoint.
                          maxLength: 253
                          minLength: 1
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          type: string
                        port:
                          description: Port defines the port of the backend endpoint.
                          format: int32
                          maximum: 65535
                          minimum: 0
                          type: integer
                      required:
                      - hostname
                      - port
                      type: object
                    hostname:
                      description: Hostname defines an optional hostname for the backend
                        endpoint.
                      maxLength: 253
                      minLength: 1
                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                      type: string
                    ip:
                      description: IP defines an IP endpoint. Supports both IPv4 and
                        IPv6 addresses.
                      properties:
                        address:
                          description: |-
                            Address defines the IP address of the backend endpoint.
                            Supports both IPv4 and IPv6 addresses.
                          maxLength: 45
                          minLength: 3
                          pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([0-9a-fA-F]{1,4}:){1,7}[0-9a-fA-F]{1,4}|::|(([0-9a-fA-F]{1,4}:){0,5})?(:[0-9a-fA-F]{1,4}){1,2})$
                          type: string
                        port:
                          description: Port defines the port of the backend endpoint.
                          format: int32
                          maximum: 65535
                          minimum: 0
                          type: integer
                      required:
                      - address
                      - port
                      type: object
                    unix:
                      description: Unix defines the unix domain socket endpoint
                      properties:
                        path:
                          description: |-
                            Path defines the unix domain socket path of the backend endpoint.
                            The path length must not exceed 108 characters.
                          type: string
                          x-kubernetes-validations:
                          - message: unix domain socket path must not exceed 108 characters
                            rule: size(self) <= 108
                      required:
                      - path
                      type: object
                    zone:
                      description: Zone defines the service zone of the backend endpoint.
                      type: string
                  type: object
                  x-kubernetes-validations:
                  - message: one of fqdn, ip or unix must be specified
                    rule: (has(self.fqdn) || has(self.ip) || has(self.unix))
                  - message: only one of fqdn, ip or unix can be specified
                    rule: ((has(self.fqdn) && !(has(self.ip) || has(self.unix))) ||
                      (has(self.ip) && !(has(self.fqdn) || has(self.unix))) || (has(self.unix)
                      && !(has(self.ip) || has(self.fqdn))))
                maxItems: 256
                minItems: 1
                type: array
                x-kubernetes-validations:
                - message: fqdn addresses cannot be mixed with other address types
                  rule: self.all(f, has(f.fqdn)) || !self.exists(f, has(f.fqdn))
              fallback:
                description: |-
                  Fallback indicates whether the backend is designated as a fallback.
                  It is highly recommended to configure active or passive health checks to ensure that failover can be detected
                  when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
                  The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
                  the health of the active backends falls below 72%.
                type: boolean
              tls:
                description: |-
                  TLS defines the TLS settings for the backend.
                  If TLS is specified here and a BackendTLSPolicy is also configured for the backend, the final TLS settings will
                  be a merge of both configurations. In case of overlapping fields, the values defined in the BackendTLSPolicy will
                  take precedence.
                properties:
                  alpnProtocols:
                    description: |-
                      ALPNProtocols supplies the list of ALPN protocols that should be
                      exposed by the listener or used by the proxy to connect to the backend.
                      Defaults:
                      1. HTTPS Routes: h2 and http/1.1 are enabled in listener context.
                      2. Other Routes: ALPN is disabled.
                      3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
                      When an empty list is provided, the ALPN TLS extension is disabled.

                      Defaults to [h2, http/1.1] if not specified.

                      Typical Supported values are:
                      - http/1.0
                      - http/1.1
                      - h2
                    items:
                      description: ALPNProtocol specifies the protocol to be negotiated
                        using ALPN
                      type: string
                    type: array
                  caCertificateRefs:
                    description: |-
                      CACertificateRefs contains one or more references to Kubernetes objects that
                      contain TLS certificates of the Certificate Authorities that can be used
                      as a trust anchor to validate the certificates presented by the backend.

                      A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
                      with the CA certificate in a key named `ca.crt` is currently supported.

                      If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
                      specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
                      not both.
                    items:
                      description: |-
                        LocalObjectReference identifies an API object within the namespace of the
                        referrer.
                        The API object must be valid in the cluster; the Group and Kind must
                        be registered in the cluster for this reference to be valid.

                        References to objects with invalid Group and Kind are not valid, and must
                        be rejected by the implementation, with appropriate Conditions set
                        on the containing object.
                      properties:
                        group:
                          description: |-
                            Group is the group of the referent. For example, "gateway.networking.k8s.io".
                            When unspecified or empty string, core API group is inferred.
                          maxLength: 253
                          pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          type: string
                        kind:
                          description: Kind is kind of the referent. For example "HTTPRoute"
                            or "Service".
                          maxLength: 63
                          minLength: 1
                          pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                          type: string
                        name:
                          description: Name is the name of the referent.
                          maxLength: 253
                          minLength: 1
                          type: string
                      required:
                      - group
                      - kind
                      - name
                      type: object
                    maxItems: 8
                    type: array
                  ciphers:
                    description: |-
                      Ciphers specifies the set of cipher suites supported when
                      negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
                      For Envoy TLS cipher suite configuration semantics and default cipher
                      lists, see the Envoy documentation:
                      https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
                      Supported cipher suite names:
                      - ECDHE-ECDSA-AES128-GCM-SHA256
                      - ECDHE-RSA-AES128-GCM-SHA256
                      - ECDHE-ECDSA-AES256-GCM-SHA384
                      - ECDHE-RSA-AES256-GCM-SHA384
                      - ECDHE-ECDSA-CHACHA20-POLY1305
                      - ECDHE-RSA-CHACHA20-POLY1305
                      - ECDHE-ECDSA-AES128-SHA
                      - ECDHE-RSA-AES128-SHA
                      - AES128-GCM-SHA256
                      - AES128-SHA
                      - ECDHE-ECDSA-AES256-SHA
                      - ECDHE-RSA-AES256-SHA
                      - AES256-GCM-SHA384
                      - AES256-SHA
                      Supported IANA/RFC aliases:
                      - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
                      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
                      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
                      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
                      - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
                      - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
                      - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
                      - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
                      - TLS_RSA_WITH_AES_128_GCM_SHA256
                      - TLS_RSA_WITH_AES_128_CBC_SHA
                      - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
                      - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
                      - TLS_RSA_WITH_AES_256_GCM_SHA384
                      - TLS_RSA_WITH_AES_256_CBC_SHA
                      In non-FIPS Envoy Proxy builds the default cipher list is:
                      - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
                      - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
                      - ECDHE-ECDSA-AES256-GCM-SHA384
                      - ECDHE-RSA-AES256-GCM-SHA384
                      In builds using BoringSSL FIPS the default cipher list is:
                      - ECDHE-ECDSA-AES128-GCM-SHA256
                      - ECDHE-RSA-AES128-GCM-SHA256
                      - ECDHE-ECDSA-AES256-GCM-SHA384
                      - ECDHE-RSA-AES256-GCM-SHA384
                    items:
                      type: string
                    type: array
                  clientCertificateRef:
                    description: |-
                      ClientCertificateRef defines the reference to a Kubernetes Secret that contains
                      the client certificate and private key for Envoy to use when connecting to
                      backend services and external services, such as ExtAuth, ALS, OpenTelemetry, etc.
                      This secret should be located within the same namespace as the Envoy proxy resource that references it.
                    properties:
                      group:
                        default: ""
                        description: |-
                          Group is the group of the referent. For example, "gateway.networking.k8s.io".
                          When unspecified or empty string, core API group is inferred.
                        maxLength: 253
                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                        type: string
                      kind:
                        default: Secret
                        description: Kind is kind of the referent. For example "Secret".
                        maxLength: 63
                        minLength: 1
                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                        type: string
                      name:
                        description: Name is the name of the referent.
                        maxLength: 253
                        minLength: 1
                        type: string
                      namespace:
                        description: |-
                          Namespace is the namespace of the referenced object. When unspecified, the local
                          namespace is inferred.

                          Note that when a namespace different than the local namespace is specified,
                          a ReferenceGrant object is required in the referent namespace to allow that
                          namespace's owner to accept the reference. See the ReferenceGrant
                          documentation for details.

                          Support: Core
                        maxLength: 63
                        minLength: 1
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                        type: string
                    required:
                    - name
                    type: object
                  ecdhCurves:
                    description: |-
                      ECDHCurves specifies the set of supported ECDH curves.
                      In non-FIPS Envoy Proxy builds the default curves are:
                      - X25519
                      - P-256
                      In builds using BoringSSL FIPS the default curve is:
                      - P-256
                    items:
                      type: string
                    type: array
                  fingerprints:
                    description: |-
                      Fingerprints specifies TLS client fingerprinting.
                      When specified, a JAX fingerprint derived from the client’s TLS handshake
                      is generated. The fingerprint can be logged in access logs or
                      forwarded to upstream services using request headers.

                      Fingerprinting is disabled if not specified.

                      Supported values are:
                      - JA3
                      - JA4
                    items:
                      description: TLSFingerprintType specifies the TLS client fingerprinting
                        mode.
                      enum:
                      - JA3
                      - JA4
                      type: string
                    type: array
                  insecureSkipVerify:
                    default: false
                    description: |-
                      InsecureSkipVerify indicates whether the upstream's certificate verification
                      should be skipped. Defaults to "false".
                    type: boolean
                  maxVersion:
                    description: |-
                      Max specifies the maximal TLS protocol version to allow
                      The default is TLS 1.3 if this is not specified.
                    enum:
                    - Auto
                    - "1.0"
                    - "1.1"
                    - "1.2"
                    - "1.3"
                    type: string
                  minVersion:
                    description: |-
                      Min specifies the minimal TLS protocol version to allow.
                      The default is TLS 1.2 if this is not specified.
                    enum:
                    - Auto
                    - "1.0"
                    - "1.1"
                    - "1.2"
                    - "1.3"
                    type: string
                  signatureAlgorithms:
                    description: |-
                      SignatureAlgorithms specifies which signature algorithms the listener should
                      support.
                    items:
                      type: string
                    type: array
                  sni:
                    description: |-
                      SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.

                      Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
                      1. Backend resources that do not set SNI, or
                      2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them

                      When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
                      over this value.
                    maxLength: 253
                    minLength: 1
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                    type: string
                  wellKnownCACertificates:
                    description: |-
                      WellKnownCACertificates specifies whether system CA certificates may be used in
                      the TLS handshake between the gateway and backend pod.

                      If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
                      must be specified with at least one entry for a valid configuration. Only one of
                      CACertificateRefs or WellKnownCACertificates may be specified, not both.
                    maxLength: 253
                    minLength: 1
                    pattern: ^(System|([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]))$
                    type: string
                type: object
                x-kubernetes-validations:
                - message: must not contain both CACertificateRefs and WellKnownCACertificates
                  rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
                    > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
                    != "")'
                - message: must not contain either CACertificateRefs or WellKnownCACertificates
                    when InsecureSkipVerify is enabled
                  rule: '!((has(self.insecureSkipVerify) && self.insecureSkipVerify)
                    && ((has(self.caCertificateRefs) && size(self.caCertificateRefs)
                    > 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates
                    != "")))'
                - message: setting ciphers has no effect if the minimum possible TLS
                    version is 1.3
                  rule: 'has(self.minVersion) && self.minVersion == ''1.3'' ? !has(self.ciphers)
                    : true'
                - message: minVersion must be smaller or equal to maxVersion
                  rule: 'has(self.minVersion) && has(self.maxVersion) ? {"Auto":0,"1.0":1,"1.1":2,"1.2":3,"1.3":4}[self.minVersion]
                    <= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion]
                    : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion]
                    : true'
              type:
                default: Endpoints
                description: Type defines the type of the backend. Defaults to "Endpoints"
                enum:
                - Endpoints
                - DynamicResolver
                type: string
            type: object
            x-kubernetes-validations:
            - message: DynamicResolver type cannot have endpoints specified
              rule: self.type != 'DynamicResolver' || !has(self.endpoints)
          status:
            description: Status defines the current status of Backend.
            properties:
              conditions:
                description: Conditions describe the current conditions of the Backend.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                maxItems: 8
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
{{- end }}