Packages CR (v1alpha1)

Packages

Field	Type	Description
spec	Spec

Spec

Field	Type	Description
monitor	Monitor[]	Create Service or Pod Monitor configurations
network	Network	Network configuration for the package
sso	Sso[]	Create SSO client configurations

Monitor

Field	Type	Description
authorization	Authorization	Authorization settings.
description	string	A description of this monitor entry, this will become part of the ServiceMonitor name
fallbackScrapeProtocol	string (enum): `OpenMetricsText0.0.1` `OpenMetricsText1.0.0` `PrometheusProto` `PrometheusText0.0.4` `PrometheusText1.0.0`	The protocol for Prometheus to use if a scrape returns a blank, unparsable, or otherwise invalid Content-Type
kind	string (enum): `PodMonitor` `ServiceMonitor`	The type of monitor to create; PodMonitor or ServiceMonitor. ServiceMonitor is the default.
path	string	HTTP path from which to scrape for metrics, defaults to `/metrics`
podSelector		Labels to match pods in the namespace to apply the policy to. Leave empty to apply to all pods in the namespace
portName	string	The port name for the serviceMonitor
selector		Labels to match pods in the namespace to apply the policy to. Leave empty to apply to all pods in the namespace
targetPort	number	The service targetPort. This is required so the NetworkPolicy can be generated correctly.

Authorization

Field	Type	Description
credentials	Credentials	Selects a key of a Secret in the namespace that contains the credentials for authentication.
type	string	Defines the authentication type. The value is case-insensitive. "Basic" is not a supported value. Default: "Bearer"

Credentials

Field	Type	Description
key	string	The key of the secret to select from. Must be a valid secret key.
name	string	Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
optional	boolean	Specify whether the Secret or its key must be defined

Network

Field	Type	Description
allow	Allow[]	Allow specific traffic (namespace will have a default-deny policy)
expose	Expose[]	Expose a service on an Istio Gateway
serviceMesh	ServiceMesh	Service Mesh configuration for the package

Allow

Field	Type	Description
description	string	A description of the policy, this will become part of the policy name
direction	string (enum): `Ingress` `Egress`	The direction of the traffic
labels		The labels to apply to the policy
podLabels		Deprecated: use selector
port	number	The port to allow (protocol is always TCP)
ports	number[]	A list of ports to allow (protocol is always TCP)
remoteCidr	string	Custom generated policy CIDR
remoteGenerated	string (enum): `KubeAPI` `KubeNodes` `IntraNamespace` `CloudMetadata` `Anywhere`	Custom generated remote selector for the policy
remoteHost	string	Remote host to allow traffic out to
remoteNamespace	string	The remote namespace to allow traffic to/from. Use * or empty string to allow all namespaces
remotePodLabels		Deprecated: use remoteSelector
remoteProtocol	string (enum): `TLS` `HTTP`	Protocol used for external connection
remoteSelector		The remote pod selector labels to allow traffic to/from
remoteServiceAccount	string	The remote service account to restrict incoming traffic from within the remote namespace. Only valid for Ingress rules.
selector		Labels to match pods in the namespace to apply the policy to. Leave empty to apply to all pods in the namespace
serviceAccount	string	The service account to restrict outgoing traffic from within the package namespace. Only valid for Egress rules.

Expose

Field	Type	Description
advancedHTTP	AdvancedHTTP	Advanced HTTP settings for the route.
description	string	A description of this expose entry, this will become part of the VirtualService name
domain	string	The domain to expose the service on, only valid for additional gateways (not tenant, admin, or passthrough)
gateway	string	The name of the gateway to expose the service on (default: tenant)
host	string	The hostname to expose the service on
match	Match[]	Match the incoming request based on custom rules. Not permitted when using the passthrough gateway.
podLabels		Deprecated: use selector
port	number	The port number to expose
selector		Labels to match pods in the namespace to apply the policy to. Leave empty to apply to all pods in the namespace
service	string	The name of the service to expose
targetPort	number	The service targetPort. This defaults to port and is only required if the service port is different from the target port (so the NetworkPolicy can be generated correctly).

AdvancedHTTP

Field	Type	Description
corsPolicy	CorsPolicy	Cross-Origin Resource Sharing policy (CORS).
directResponse	DirectResponse	A HTTP rule can either return a direct_response, redirect or forward (default) traffic.
headers	Headers
match	Match[]	Match the incoming request based on custom rules. Not permitted when using the passthrough gateway.
redirect	Redirect	A HTTP rule can either return a direct_response, redirect or forward (default) traffic.
retries	Retries	Retry policy for HTTP requests.
rewrite	Rewrite	Rewrite HTTP URIs and Authority headers.
timeout	string	Timeout for HTTP requests, default is disabled.
weight	integer	Weight specifies the relative proportion of traffic to be forwarded to the destination.

CorsPolicy

Field	Type	Description
allowCredentials	boolean	Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials.
allowHeaders	string[]	List of HTTP headers that can be used when requesting the resource.
allowMethods	string[]	List of HTTP methods allowed to access the resource.
allowOrigin	string[]
allowOrigins	AllowOrigins[]	String patterns that match allowed origins.
exposeHeaders	string[]	A list of HTTP headers that the browsers are allowed to access.
maxAge	string	Specifies how long the results of a preflight request can be cached.

AllowOrigins

Field	Type	Description
exact	string
prefix	string
regex	string	RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).

DirectResponse

Field	Type	Description
body	Body	Specifies the content of the response body.

Body

Field	Type	Description
bytes	string	response body as base64 encoded bytes.
string	string

Headers

Field	Type	Description
request	Request
response	Response

Request

Field	Type	Description
add
remove	string[]
set

Response

Field	Type	Description
add
remove	string[]
set

Match

Field	Type	Description
ignoreUriCase	boolean	Flag to specify whether the URI matching should be case-insensitive.
method	Method
name	string	The name assigned to a match.
queryParams		Query parameters for matching.
uri	Uri

Method

Field	Type	Description
exact	string
prefix	string
regex	string	RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).

Uri

Field	Type	Description
exact	string
prefix	string
regex	string	RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).

Redirect

Field	Type	Description
authority	string	On a redirect, overwrite the Authority/Host portion of the URL with this value.
derivePort	string (enum): `FROM_PROTOCOL_DEFAULT` `FROM_REQUEST_PORT`	On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT
port	integer	On a redirect, overwrite the port portion of the URL with this value.
redirectCode	integer	On a redirect, Specifies the HTTP status code to use in the redirect response.
scheme	string	On a redirect, overwrite the scheme portion of the URL with this value.
uri	string	On a redirect, overwrite the Path portion of the URL with this value.

Retries

Field	Type	Description
attempts	integer	Number of retries to be allowed for a given request.
perTryTimeout	string	Timeout per attempt for a given request, including the initial call and any retries.
retryOn	string	Specifies the conditions under which retry takes place.
retryRemoteLocalities	boolean	Flag to specify whether the retries should retry to other localities.

Rewrite

Field	Type	Description
authority	string	rewrite the Authority/Host header with this value.
uri	string	rewrite the path (or the prefix) portion of the URI with this value.
uriRegexRewrite	UriRegexRewrite	rewrite the path portion of the URI with the specified regex.

UriRegexRewrite

Field	Type	Description
match	string	RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
rewrite	string	The string that should replace into matching portions of original URI.

Match

Field	Type	Description
ignoreUriCase	boolean	Flag to specify whether the URI matching should be case-insensitive.
method	Method
name	string	The name assigned to a match.
queryParams		Query parameters for matching.
uri	Uri

Method

Field	Type	Description
exact	string
prefix	string
regex	string	RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).

Uri

Field	Type	Description
exact	string
prefix	string
regex	string	RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).

ServiceMesh

Field	Type	Description
mode	string (enum): `sidecar` `ambient`	Set the service mesh mode for this package (namespace), defaults to sidecar

Sso

Field	Type	Description
adminUrl	string	This URL will be used for every binding to both the SP's Assertion Consumer and Single Logout Services.
alwaysDisplayInConsole	boolean	Always list this client in the Account UI, even if the user does not have an active session.
attributes		Specifies attributes for the client.
baseUrl	string	Default URL to use when the auth server needs to redirect or link back to the client.
clientAuthenticatorType	string (enum): `client-secret` `client-jwt`	The client authenticator type
clientId	string	The client identifier registered with the identity provider.
defaultClientScopes	string[]	Default client scopes
description	string	A description for the client, can be a URL to an image to replace the login logo
enableAuthserviceSelector		Labels to match pods to automatically protect with authservice. Leave empty to disable authservice protection
enabled	boolean	Whether the SSO client is enabled
groups	Groups	The client SSO group type
name	string	Specifies display name of the client
protocol	string (enum): `openid-connect` `saml`	Specifies the protocol of the client, either 'openid-connect' or 'saml'
protocolMappers	ProtocolMappers[]	Protocol Mappers to configure on the client
publicClient	boolean	Defines whether the client requires a client secret for authentication
redirectUris	string[]	Valid URI pattern a browser can redirect to after a successful login. Simple wildcards are allowed such as 'https://unicorns.uds.dev/*'
rootUrl	string	Root URL appended to relative URLs
secret	string	The client secret. Typically left blank and auto-generated.
secretAnnotations		Additional annotations to apply to the generated secret, can be used for pod reloading with a selector
secretLabels		Additional labels to apply to the generated secret, can be used for pod reloading
secretName	string	The name of the secret to store the client secret
secretTemplate		A template for the generated secret
serviceAccountsEnabled	boolean	Enables the client credentials grant based authentication via OpenID Connect protocol.
standardFlowEnabled	boolean	Enables the standard OpenID Connect redirect based authentication with authorization code.
webOrigins	string[]	Allowed CORS origins. To permit all origins of Valid Redirect URIs, add '+'. This does not include the '' wildcard though. To permit all origins, explicitly add ''.

Groups

Field	Type	Description
anyOf	string[]	List of groups allowed to access the client

ProtocolMappers

Field	Type	Description
config		Configuration options for the mapper.
consentRequired	boolean	Whether user consent is required for this mapper
name	string	Name of the mapper
protocol	string (enum): `openid-connect` `saml`	Protocol of the mapper
protocolMapper	string	Protocol Mapper type of the mapper

Cookie Settings Privacy Policy