diff --git a/.github/workflows/notebook_controller_m2m_test.yaml b/.github/workflows/notebook_controller_m2m_test.yaml
index bc0001e9f6..cb70027de1 100644
--- a/.github/workflows/notebook_controller_m2m_test.yaml
+++ b/.github/workflows/notebook_controller_m2m_test.yaml
@@ -34,7 +34,7 @@ jobs:
run: ./tests/gh-actions/install_oauth2-proxy.sh
- name: Install kubeflow-istio-resources
- run: kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+ run: kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
- name: Install KF Multi Tenancy
run: ./tests/gh-actions/install_multi_tenancy.sh
diff --git a/.github/workflows/pipeline_run_from_notebook.yaml b/.github/workflows/pipeline_run_from_notebook.yaml
index ff965b7937..1cb526310a 100644
--- a/.github/workflows/pipeline_run_from_notebook.yaml
+++ b/.github/workflows/pipeline_run_from_notebook.yaml
@@ -37,7 +37,7 @@ jobs:
run: kustomize build common/kubeflow-namespace/base | kubectl apply -f -
- name: Install kubeflow-istio-resources
- run: kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+ run: kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
- name: Install KF Pipelines
run: ./tests/gh-actions/install_pipelines.sh
diff --git a/.github/workflows/pipeline_swfs_test.yaml b/.github/workflows/pipeline_swfs_test.yaml
index 2489ee3201..6bebea16e7 100644
--- a/.github/workflows/pipeline_swfs_test.yaml
+++ b/.github/workflows/pipeline_swfs_test.yaml
@@ -45,7 +45,7 @@ jobs:
run: ./tests/gh-actions/install_multi_tenancy.sh
- name: Install kubeflow-istio-resources
- run: kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+ run: kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
- name: Create KF Profile
run: kustomize build common/user-namespace/base | kubectl apply -f -
diff --git a/.github/workflows/pipeline_test.yaml b/.github/workflows/pipeline_test.yaml
index f5944e0643..5c73d1ce27 100644
--- a/.github/workflows/pipeline_test.yaml
+++ b/.github/workflows/pipeline_test.yaml
@@ -44,7 +44,7 @@ jobs:
run: ./tests/gh-actions/install_multi_tenancy.sh
- name: Install kubeflow-istio-resources
- run: kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+ run: kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
- name: Create KF Profile
run: kustomize build common/user-namespace/base | kubectl apply -f -
diff --git a/.github/workflows/training_operator_test.yaml b/.github/workflows/training_operator_test.yaml
index d63f0b934f..d90957c2bc 100644
--- a/.github/workflows/training_operator_test.yaml
+++ b/.github/workflows/training_operator_test.yaml
@@ -38,7 +38,7 @@ jobs:
run: ./tests/gh-actions/install_multi_tenancy.sh
- name: Install kubeflow-istio-resources
- run: kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+ run: kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
- name: Create KF Profile
run: kustomize build common/user-namespace/base | kubectl apply -f -
diff --git a/README.md b/README.md
old mode 100755
new mode 100644
index b79207da60..0f992b46af
--- a/README.md
+++ b/README.md
@@ -64,7 +64,7 @@ used from the different projects of Kubeflow:
| Component | Local Manifests Path | Upstream Revision |
| - | - | - |
-| Istio | common/istio-1-22 | [1.23.2](https://github.com/istio/istio/releases/tag/1.23.2) |
+| Istio | common/istio-1-23 | [1.23.2](https://github.com/istio/istio/releases/tag/1.23.2) |
| Knative | common/knative/knative-serving
common/knative/knative-eventing | [v1.12.4](https://github.com/knative/serving/releases/tag/knative-v1.12.4)
[v1.12.6](https://github.com/knative/eventing/releases/tag/knative-v1.12.6) |
| Cert Manager | common/cert-manager | [1.14.5](https://github.com/cert-manager/cert-manager/releases/tag/v1.12.2) |
@@ -209,9 +209,9 @@ Install Istio:
```sh
echo "Installing Istio configured with external authorization..."
-kustomize build common/istio-1-22/istio-crds/base | kubectl apply -f -
-kustomize build common/istio-1-22/istio-namespace/base | kubectl apply -f -
-kustomize build common/istio-1-22/istio-install/overlays/oauth2-proxy | kubectl apply -f -
+kustomize build common/istio-1-23/istio-crds/base | kubectl apply -f -
+kustomize build common/istio-1-23/istio-namespace/base | kubectl apply -f -
+kustomize build common/istio-1-23/istio-install/overlays/oauth2-proxy | kubectl apply -f -
echo "Waiting for all Istio Pods to become ready..."
kubectl wait --for=condition=Ready pods --all -n istio-system --timeout 300s
@@ -265,7 +265,7 @@ Install Knative Serving:
```sh
kustomize build common/knative/knative-serving/overlays/gateways | kubectl apply -f -
-kustomize build common/istio-1-22/cluster-local-gateway/base | kubectl apply -f -
+kustomize build common/istio-1-23/cluster-local-gateway/base | kubectl apply -f -
```
Optionally, you can install Knative Eventing which can be used for inference request logging:
@@ -312,7 +312,7 @@ Create the Kubeflow Gateway, `kubeflow-gateway` and ClusterRole,
Install kubeflow istio resources:
```sh
-kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
```
#### Kubeflow Pipelines
diff --git a/common/istio-1-22/README.md b/common/istio-1-23/README.md
similarity index 100%
rename from common/istio-1-22/README.md
rename to common/istio-1-23/README.md
diff --git a/common/istio-1-22/cluster-local-gateway/base/cluster-local-gateway.yaml b/common/istio-1-23/cluster-local-gateway/base/cluster-local-gateway.yaml
similarity index 98%
rename from common/istio-1-22/cluster-local-gateway/base/cluster-local-gateway.yaml
rename to common/istio-1-23/cluster-local-gateway/base/cluster-local-gateway.yaml
index 93265e3e8c..45441c6a4f 100644
--- a/common/istio-1-22/cluster-local-gateway/base/cluster-local-gateway.yaml
+++ b/common/istio-1-23/cluster-local-gateway/base/cluster-local-gateway.yaml
@@ -109,8 +109,7 @@ spec:
- name: ISTIO_META_WORKLOAD_NAME
value: cluster-local-gateway
- name: ISTIO_META_OWNER
- value:
- kubernetes://apis/apps/v1/namespaces/istio-system/deployments/cluster-local-gateway
+ value: kubernetes://apis/apps/v1/namespaces/istio-system/deployments/cluster-local-gateway
- name: ISTIO_META_MESH_ID
value: cluster.local
- name: TRUST_DOMAIN
@@ -123,7 +122,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- image: docker.io/istio/proxyv2:1.22.1
+ image: docker.io/istio/proxyv2:1.23.2
name: istio-proxy
ports:
- containerPort: 15020
diff --git a/common/istio-1-22/cluster-local-gateway/base/gateway-authorizationpolicy.yaml b/common/istio-1-23/cluster-local-gateway/base/gateway-authorizationpolicy.yaml
similarity index 100%
rename from common/istio-1-22/cluster-local-gateway/base/gateway-authorizationpolicy.yaml
rename to common/istio-1-23/cluster-local-gateway/base/gateway-authorizationpolicy.yaml
diff --git a/common/istio-1-22/cluster-local-gateway/base/gateway.yaml b/common/istio-1-23/cluster-local-gateway/base/gateway.yaml
similarity index 100%
rename from common/istio-1-22/cluster-local-gateway/base/gateway.yaml
rename to common/istio-1-23/cluster-local-gateway/base/gateway.yaml
diff --git a/common/istio-1-22/cluster-local-gateway/base/kustomization.yaml b/common/istio-1-23/cluster-local-gateway/base/kustomization.yaml
similarity index 100%
rename from common/istio-1-22/cluster-local-gateway/base/kustomization.yaml
rename to common/istio-1-23/cluster-local-gateway/base/kustomization.yaml
diff --git a/common/istio-1-22/cluster-local-gateway/base/patches/remove-pdb.yaml b/common/istio-1-23/cluster-local-gateway/base/patches/remove-pdb.yaml
similarity index 100%
rename from common/istio-1-22/cluster-local-gateway/base/patches/remove-pdb.yaml
rename to common/istio-1-23/cluster-local-gateway/base/patches/remove-pdb.yaml
diff --git a/common/istio-1-22/istio-crds/base/crd.yaml b/common/istio-1-23/istio-crds/base/crd.yaml
similarity index 88%
rename from common/istio-1-22/istio-crds/base/crd.yaml
rename to common/istio-1-23/istio-crds/base/crd.yaml
index 6907d037fa..33de713fcc 100644
--- a/common/istio-1-22/istio-crds/base/crd.yaml
+++ b/common/istio-1-23/istio-crds/base/crd.yaml
@@ -212,43 +212,87 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
targetRef:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
type: object
status:
@@ -447,43 +491,87 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
targetRef:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
type: object
status:
@@ -598,6 +686,10 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -626,12 +718,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -645,6 +749,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the
@@ -657,6 +765,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -822,12 +934,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -855,6 +973,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -905,6 +1026,10 @@ spec:
description: The idle timeout for upstream
connection pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent
streams allowed for a peer on one HTTP/2
@@ -935,12 +1060,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP
connections to a destination host.
@@ -954,6 +1091,10 @@ spec:
description: The time duration between
keep-alive probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive
probes to send without response before
@@ -966,6 +1107,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -1136,12 +1281,20 @@ spec:
description: Represents the warmup duration of
Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host
is ejected from the connection pool.
@@ -1170,6 +1323,10 @@ spec:
description: Time interval between ejection sweep
analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -1252,6 +1409,7 @@ spec:
type: array
type: object
type: object
+ maxItems: 4096
type: array
proxyProtocol:
description: The upstream PROXY protocol settings.
@@ -1378,6 +1536,9 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -1405,12 +1566,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -1424,6 +1594,9 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes to
send without response before deciding the connection
@@ -1436,6 +1609,9 @@ spec:
to be idle before keep-alive probes start being
sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -1598,12 +1774,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -1631,6 +1813,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing pool
for the upstream service that can be ejected.
@@ -1681,6 +1866,10 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -1709,12 +1898,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -1728,6 +1929,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the
@@ -1740,6 +1945,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -1905,12 +2114,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -1938,6 +2153,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -2017,6 +2235,7 @@ spec:
type: array
type: object
type: object
+ maxItems: 4096
type: array
proxyProtocol:
description: The upstream PROXY protocol settings.
@@ -2112,10 +2331,20 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
required:
- host
@@ -2205,6 +2434,10 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -2233,12 +2466,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -2252,6 +2497,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the
@@ -2264,6 +2513,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -2429,12 +2682,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -2462,6 +2721,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -2512,6 +2774,10 @@ spec:
description: The idle timeout for upstream
connection pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent
streams allowed for a peer on one HTTP/2
@@ -2542,12 +2808,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP
connections to a destination host.
@@ -2561,6 +2839,10 @@ spec:
description: The time duration between
keep-alive probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive
probes to send without response before
@@ -2573,6 +2855,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -2743,12 +3029,20 @@ spec:
description: Represents the warmup duration of
Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host
is ejected from the connection pool.
@@ -2777,6 +3071,10 @@ spec:
description: Time interval between ejection sweep
analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -2859,6 +3157,7 @@ spec:
type: array
type: object
type: object
+ maxItems: 4096
type: array
proxyProtocol:
description: The upstream PROXY protocol settings.
@@ -2985,6 +3284,9 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -3012,12 +3314,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -3031,6 +3342,9 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes to
send without response before deciding the connection
@@ -3043,6 +3357,9 @@ spec:
to be idle before keep-alive probes start being
sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -3205,12 +3522,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -3238,6 +3561,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing pool
for the upstream service that can be ejected.
@@ -3288,6 +3614,10 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -3316,12 +3646,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -3335,6 +3677,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the
@@ -3347,6 +3693,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -3512,12 +3862,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -3545,6 +3901,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -3624,6 +3983,7 @@ spec:
type: array
type: object
type: object
+ maxItems: 4096
type: array
proxyProtocol:
description: The upstream PROXY protocol settings.
@@ -3719,10 +4079,20 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
required:
- host
@@ -3812,6 +4182,10 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -3840,12 +4214,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -3859,6 +4245,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the
@@ -3871,6 +4261,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -4036,12 +4430,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -4069,6 +4469,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -4119,6 +4522,10 @@ spec:
description: The idle timeout for upstream
connection pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent
streams allowed for a peer on one HTTP/2
@@ -4149,12 +4556,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP
connections to a destination host.
@@ -4168,6 +4587,10 @@ spec:
description: The time duration between
keep-alive probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive
probes to send without response before
@@ -4180,6 +4603,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -4350,12 +4777,20 @@ spec:
description: Represents the warmup duration of
Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host
is ejected from the connection pool.
@@ -4384,6 +4819,10 @@ spec:
description: Time interval between ejection sweep
analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -4466,6 +4905,7 @@ spec:
type: array
type: object
type: object
+ maxItems: 4096
type: array
proxyProtocol:
description: The upstream PROXY protocol settings.
@@ -4592,6 +5032,9 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -4619,12 +5062,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -4638,6 +5090,9 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes to
send without response before deciding the connection
@@ -4650,6 +5105,9 @@ spec:
to be idle before keep-alive probes start being
sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -4812,12 +5270,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -4845,6 +5309,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing pool
for the upstream service that can be ejected.
@@ -4895,6 +5362,10 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -4923,12 +5394,24 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -4942,6 +5425,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the
@@ -4954,6 +5441,10 @@ spec:
needs to be idle before keep-alive probes
start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater
+ than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -5119,12 +5610,18 @@ spec:
warmupDurationSecs:
description: Represents the warmup duration of Service.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
outlierDetection:
properties:
baseEjectionTime:
description: Minimum ejection duration.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
consecutive5xxErrors:
description: Number of 5xx errors before a host is ejected
from the connection pool.
@@ -5152,6 +5649,9 @@ spec:
interval:
description: Time interval between ejection sweep analysis.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxEjectionPercent:
description: Maximum % of hosts in the load balancing
pool for the upstream service that can be ejected.
@@ -5231,6 +5731,7 @@ spec:
type: array
type: object
type: object
+ maxItems: 4096
type: array
proxyProtocol:
description: The upstream PROXY protocol settings.
@@ -5326,10 +5827,20 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
required:
- host
@@ -5620,17 +6131,34 @@ spec:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
workloadSelector:
description: Criteria used to select the specific set of pods/VMs
@@ -6242,19 +6770,37 @@ spec:
type: string
type: object
description: Port specific mutual TLS settings.
+ minProperties: 1
type: object
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: self.all(key, 0 < int(key) && int(key) <= 65535)
selector:
description: The selector determines the workloads to apply the PeerAuthentication
on.
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
type: object
+ x-kubernetes-validations:
+ - message: portLevelMtls requires selector
+ rule: (has(self.selector) && has(self.selector.matchLabels) && self.selector.matchLabels.size()
+ > 0) || !has(self.portLevelMtls)
status:
type: object
x-kubernetes-preserve-unknown-fields: true
@@ -6315,19 +6861,37 @@ spec:
type: string
type: object
description: Port specific mutual TLS settings.
+ minProperties: 1
type: object
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: self.all(key, 0 < int(key) && int(key) <= 65535)
selector:
description: The selector determines the workloads to apply the PeerAuthentication
on.
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
type: object
+ x-kubernetes-validations:
+ - message: portLevelMtls requires selector
+ rule: (has(self.selector) && has(self.selector.matchLabels) && self.selector.matchLabels.size()
+ > 0) || !has(self.portLevelMtls)
status:
type: object
x-kubernetes-preserve-unknown-fields: true
@@ -6372,10 +6936,12 @@ spec:
concurrency:
description: The number of worker threads to run.
format: int32
+ minimum: 0
nullable: true
type: integer
environmentVariables:
additionalProperties:
+ maxLength: 2048
type: string
description: Additional environment variables for the proxy.
type: object
@@ -6391,10 +6957,20 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
type: object
status:
@@ -6450,6 +7026,7 @@ spec:
description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3)
that are allowed to access.
items:
+ minLength: 1
type: string
type: array
forwardOriginalToken:
@@ -6459,6 +7036,7 @@ spec:
fromCookies:
description: List of cookie names from which JWT is expected.
items:
+ minLength: 1
type: string
type: array
fromHeaders:
@@ -6467,6 +7045,7 @@ spec:
properties:
name:
description: The HTTP header name.
+ minLength: 1
type: string
prefix:
description: The prefix that should be stripped before
@@ -6479,10 +7058,12 @@ spec:
fromParams:
description: List of query parameters from which JWT is expected.
items:
+ minLength: 1
type: string
type: array
issuer:
description: Identifies the issuer that issued the JWT.
+ minLength: 1
type: string
jwks:
description: JSON Web Key Set of public keys to validate signature
@@ -6491,11 +7072,21 @@ spec:
jwks_uri:
description: URL of the provider's public key set to validate
signature of the JWT.
+ maxLength: 2048
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: url must have scheme http:// or https://
+ rule: url(self).getScheme() in ['http', 'https']
jwksUri:
description: URL of the provider's public key set to validate
signature of the JWT.
+ maxLength: 2048
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: url must have scheme http:// or https://
+ rule: url(self).getScheme() in ['http', 'https']
outputClaimToHeaders:
description: This field specifies a list of operations to copy
the claim to HTTP headers on a successfully verified token.
@@ -6503,10 +7094,16 @@ spec:
properties:
claim:
description: The name of the claim to be copied from.
+ minLength: 1
type: string
header:
description: The name of the header to be created.
+ minLength: 1
+ pattern: ^[-_A-Za-z0-9]+$
type: string
+ required:
+ - header
+ - claim
type: object
type: array
outputPayloadToHeader:
@@ -6518,54 +7115,108 @@ spec:
by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable,
will spend waiting for the JWKS to be fetched.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
required:
- issuer
type: object
+ x-kubernetes-validations:
+ - message: only one of jwks or jwksUri can be set
+ rule: (has(self.jwksUri)?1:0)+(has(self.jwks_uri)?1:0)+(has(self.jwks)?1:0)<=1
+ maxItems: 4096
type: array
selector:
description: Optional.
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
targetRef:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
type: object
+ x-kubernetes-validations:
+ - message: only one of targetRefs or workloadSelector can be set
+ rule: (has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1
status:
type: object
x-kubernetes-preserve-unknown-fields: true
@@ -6591,6 +7242,7 @@ spec:
description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3)
that are allowed to access.
items:
+ minLength: 1
type: string
type: array
forwardOriginalToken:
@@ -6600,6 +7252,7 @@ spec:
fromCookies:
description: List of cookie names from which JWT is expected.
items:
+ minLength: 1
type: string
type: array
fromHeaders:
@@ -6608,6 +7261,7 @@ spec:
properties:
name:
description: The HTTP header name.
+ minLength: 1
type: string
prefix:
description: The prefix that should be stripped before
@@ -6620,10 +7274,12 @@ spec:
fromParams:
description: List of query parameters from which JWT is expected.
items:
+ minLength: 1
type: string
type: array
issuer:
description: Identifies the issuer that issued the JWT.
+ minLength: 1
type: string
jwks:
description: JSON Web Key Set of public keys to validate signature
@@ -6632,11 +7288,21 @@ spec:
jwks_uri:
description: URL of the provider's public key set to validate
signature of the JWT.
+ maxLength: 2048
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: url must have scheme http:// or https://
+ rule: url(self).getScheme() in ['http', 'https']
jwksUri:
description: URL of the provider's public key set to validate
signature of the JWT.
+ maxLength: 2048
+ minLength: 1
type: string
+ x-kubernetes-validations:
+ - message: url must have scheme http:// or https://
+ rule: url(self).getScheme() in ['http', 'https']
outputClaimToHeaders:
description: This field specifies a list of operations to copy
the claim to HTTP headers on a successfully verified token.
@@ -6644,10 +7310,16 @@ spec:
properties:
claim:
description: The name of the claim to be copied from.
+ minLength: 1
type: string
header:
description: The name of the header to be created.
+ minLength: 1
+ pattern: ^[-_A-Za-z0-9]+$
type: string
+ required:
+ - header
+ - claim
type: object
type: array
outputPayloadToHeader:
@@ -6659,54 +7331,108 @@ spec:
by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable,
will spend waiting for the JWKS to be fetched.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
required:
- issuer
type: object
+ x-kubernetes-validations:
+ - message: only one of jwks or jwksUri can be set
+ rule: (has(self.jwksUri)?1:0)+(has(self.jwks_uri)?1:0)+(has(self.jwks)?1:0)<=1
+ maxItems: 4096
type: array
selector:
description: Optional.
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
targetRef:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
type: object
+ x-kubernetes-validations:
+ - message: only one of targetRefs or workloadSelector can be set
+ rule: (has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1
status:
type: object
x-kubernetes-preserve-unknown-fields: true
@@ -6784,29 +7510,48 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) ==\
+ \ '/' || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') :\
+ \ true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident
in the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload
if a sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -6814,6 +7559,13 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: Address is required
+ rule: has(self.address) || has(self.network)
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://'))\
+ \ ? !has(self.ports) : true"
+ maxItems: 4096
type: array
exportTo:
description: A list of namespaces to which this service is exported.
@@ -6940,29 +7692,48 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) ==\
+ \ '/' || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') :\
+ \ true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident
in the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload
if a sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -6970,6 +7741,13 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: Address is required
+ rule: has(self.address) || has(self.network)
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://'))\
+ \ ? !has(self.ports) : true"
+ maxItems: 4096
type: array
exportTo:
description: A list of namespaces to which this service is exported.
@@ -7096,29 +7874,48 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) ==\
+ \ '/' || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') :\
+ \ true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident
in the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload
if a sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -7126,6 +7923,13 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: Address is required
+ rule: has(self.address) || has(self.network)
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://'))\
+ \ ? !has(self.ports) : true"
+ maxItems: 4096
type: array
exportTo:
description: A list of namespaces to which this service is exported.
@@ -7322,6 +8126,9 @@ spec:
description: The idle timeout for upstream connection pool
connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams allowed
for a peer on one HTTP/2 connection.
@@ -7348,12 +8155,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections to a
destination host.
@@ -7366,6 +8182,9 @@ spec:
interval:
description: The time duration between keep-alive probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes to send
without response before deciding the connection is dead.
@@ -7376,6 +8195,9 @@ spec:
description: The time duration a connection needs to be
idle before keep-alive probes start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -7429,6 +8251,9 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -7456,12 +8281,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -7475,6 +8309,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the connection
@@ -7487,6 +8325,10 @@ spec:
to be idle before keep-alive probes start being
sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -7748,6 +8590,9 @@ spec:
description: The idle timeout for upstream connection pool
connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams allowed
for a peer on one HTTP/2 connection.
@@ -7774,12 +8619,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections to a
destination host.
@@ -7792,6 +8646,9 @@ spec:
interval:
description: The time duration between keep-alive probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes to send
without response before deciding the connection is dead.
@@ -7802,6 +8659,9 @@ spec:
description: The time duration a connection needs to be
idle before keep-alive probes start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -7855,6 +8715,9 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -7882,12 +8745,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -7901,6 +8773,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the connection
@@ -7913,6 +8789,10 @@ spec:
to be idle before keep-alive probes start being
sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -8174,6 +9054,9 @@ spec:
description: The idle timeout for upstream connection pool
connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams allowed
for a peer on one HTTP/2 connection.
@@ -8200,12 +9083,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections to a
destination host.
@@ -8218,6 +9110,9 @@ spec:
interval:
description: The time duration between keep-alive probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes to send
without response before deciding the connection is dead.
@@ -8228,6 +9123,9 @@ spec:
description: The time duration a connection needs to be
idle before keep-alive probes start being sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -8281,6 +9179,9 @@ spec:
description: The idle timeout for upstream connection
pool connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConcurrentStreams:
description: The maximum number of concurrent streams
allowed for a peer on one HTTP/2 connection.
@@ -8308,12 +9209,21 @@ spec:
connectTimeout:
description: TCP connection timeout.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
idleTimeout:
description: The idle timeout for TCP connections.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnectionDuration:
description: The maximum duration of a connection.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
maxConnections:
description: Maximum number of HTTP1 /TCP connections
to a destination host.
@@ -8327,6 +9237,10 @@ spec:
description: The time duration between keep-alive
probes.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
probes:
description: Maximum number of keepalive probes
to send without response before deciding the connection
@@ -8339,6 +9253,10 @@ spec:
to be idle before keep-alive probes start being
sent.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than
+ 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: object
type: object
@@ -8681,11 +9599,11 @@ spec:
type: object
x-kubernetes-validations:
- message: value must be set when operation is UPSERT
- rule: "((has(self.operation) ? self.operation : '')
- == 'UPSERT') ? self.value != '' : true"
+ rule: "((has(self.operation) ? self.operation : '')\
+ \ == 'UPSERT') ? self.value != '' : true"
- message: value must not be set when operation is REMOVE
- rule: "((has(self.operation) ? self.operation : '')
- == 'REMOVE') ? !has(self.value) : true"
+ rule: "((has(self.operation) ? self.operation : '')\
+ \ == 'REMOVE') ? !has(self.value) : true"
description: Optional.
type: object
type: object
@@ -8705,6 +9623,9 @@ spec:
reportingInterval:
description: Optional.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: array
selector:
@@ -8712,43 +9633,87 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
targetRef:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
tracing:
description: Optional.
@@ -9008,11 +9973,11 @@ spec:
type: object
x-kubernetes-validations:
- message: value must be set when operation is UPSERT
- rule: "((has(self.operation) ? self.operation : '')
- == 'UPSERT') ? self.value != '' : true"
+ rule: "((has(self.operation) ? self.operation : '')\
+ \ == 'UPSERT') ? self.value != '' : true"
- message: value must not be set when operation is REMOVE
- rule: "((has(self.operation) ? self.operation : '')
- == 'REMOVE') ? !has(self.value) : true"
+ rule: "((has(self.operation) ? self.operation : '')\
+ \ == 'REMOVE') ? !has(self.value) : true"
description: Optional.
type: object
type: object
@@ -9032,6 +9997,9 @@ spec:
reportingInterval:
description: Optional.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: array
selector:
@@ -9039,43 +10007,87 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
targetRef:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
tracing:
description: Optional.
@@ -9316,7 +10328,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
type: array
@@ -9330,6 +10342,19 @@ spec:
description: Specifies how long the results of a preflight
request can be cached.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
+ unmatchedPreflights:
+ description: |-
+ Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
+
+ Valid Options: FORWARD, IGNORE
+ enum:
+ - UNSPECIFIED
+ - FORWARD
+ - IGNORE
+ type: string
type: object
delegate:
description: Delegate is used to specify the particular VirtualService
@@ -9437,10 +10462,16 @@ spec:
properties:
exponentialDelay:
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
fixedDelay:
description: Add a fixed delay before forwarding the
request.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
percent:
description: Percentage of requests on which the delay
will be injected (0-100).
@@ -9498,7 +10529,7 @@ spec:
description: 'HTTP Authority values are case-sensitive
and formatted as follows: - `exact: "value"` for exact
string match - `prefix: "value"` for prefix-based match
- - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -9520,7 +10551,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
gateways:
@@ -9552,7 +10583,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: The header keys must be lowercase and use
@@ -9566,7 +10597,7 @@ spec:
description: 'HTTP Method values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -9588,7 +10619,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
name:
@@ -9623,7 +10654,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: Query parameters for matching.
@@ -9632,7 +10663,7 @@ spec:
description: 'URI Scheme values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -9654,7 +10685,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
sourceLabels:
@@ -9676,7 +10707,7 @@ spec:
description: 'URI to match values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -9698,7 +10729,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
withoutHeaders:
@@ -9724,7 +10755,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: withoutHeader has the same syntax with the
@@ -9876,6 +10907,9 @@ spec:
description: Timeout per attempt for a given request, including
the initial call and any retries.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
retryOn:
description: Specifies the conditions under which retry
takes place.
@@ -9902,7 +10936,7 @@ spec:
specified regex.
properties:
match:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
rewrite:
description: The string that should replace into matching
@@ -9984,6 +11018,9 @@ spec:
timeout:
description: Timeout for HTTP requests, default is disabled.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: array
tcp:
@@ -10259,7 +11296,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
type: array
@@ -10273,6 +11310,19 @@ spec:
description: Specifies how long the results of a preflight
request can be cached.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
+ unmatchedPreflights:
+ description: |-
+ Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
+
+ Valid Options: FORWARD, IGNORE
+ enum:
+ - UNSPECIFIED
+ - FORWARD
+ - IGNORE
+ type: string
type: object
delegate:
description: Delegate is used to specify the particular VirtualService
@@ -10380,10 +11430,16 @@ spec:
properties:
exponentialDelay:
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
fixedDelay:
description: Add a fixed delay before forwarding the
request.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
percent:
description: Percentage of requests on which the delay
will be injected (0-100).
@@ -10441,7 +11497,7 @@ spec:
description: 'HTTP Authority values are case-sensitive
and formatted as follows: - `exact: "value"` for exact
string match - `prefix: "value"` for prefix-based match
- - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -10463,7 +11519,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
gateways:
@@ -10495,7 +11551,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: The header keys must be lowercase and use
@@ -10509,7 +11565,7 @@ spec:
description: 'HTTP Method values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -10531,7 +11587,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
name:
@@ -10566,7 +11622,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: Query parameters for matching.
@@ -10575,7 +11631,7 @@ spec:
description: 'URI Scheme values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -10597,7 +11653,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
sourceLabels:
@@ -10619,7 +11675,7 @@ spec:
description: 'URI to match values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -10641,7 +11697,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
withoutHeaders:
@@ -10667,7 +11723,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: withoutHeader has the same syntax with the
@@ -10819,6 +11875,9 @@ spec:
description: Timeout per attempt for a given request, including
the initial call and any retries.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
retryOn:
description: Specifies the conditions under which retry
takes place.
@@ -10845,7 +11904,7 @@ spec:
specified regex.
properties:
match:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
rewrite:
description: The string that should replace into matching
@@ -10927,6 +11986,9 @@ spec:
timeout:
description: Timeout for HTTP requests, default is disabled.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: array
tcp:
@@ -11202,7 +12264,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
type: array
@@ -11216,6 +12278,19 @@ spec:
description: Specifies how long the results of a preflight
request can be cached.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
+ unmatchedPreflights:
+ description: |-
+ Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
+
+ Valid Options: FORWARD, IGNORE
+ enum:
+ - UNSPECIFIED
+ - FORWARD
+ - IGNORE
+ type: string
type: object
delegate:
description: Delegate is used to specify the particular VirtualService
@@ -11323,10 +12398,16 @@ spec:
properties:
exponentialDelay:
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
fixedDelay:
description: Add a fixed delay before forwarding the
request.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
percent:
description: Percentage of requests on which the delay
will be injected (0-100).
@@ -11384,7 +12465,7 @@ spec:
description: 'HTTP Authority values are case-sensitive
and formatted as follows: - `exact: "value"` for exact
string match - `prefix: "value"` for prefix-based match
- - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -11406,7 +12487,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
gateways:
@@ -11438,7 +12519,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: The header keys must be lowercase and use
@@ -11452,7 +12533,7 @@ spec:
description: 'HTTP Method values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -11474,7 +12555,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
name:
@@ -11509,7 +12590,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: Query parameters for matching.
@@ -11518,7 +12599,7 @@ spec:
description: 'URI Scheme values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -11540,7 +12621,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
sourceLabels:
@@ -11562,7 +12643,7 @@ spec:
description: 'URI to match values are case-sensitive and
formatted as follows: - `exact: "value"` for exact string
match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+ "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
oneOf:
- not:
anyOf:
@@ -11584,7 +12665,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
withoutHeaders:
@@ -11610,7 +12691,7 @@ spec:
prefix:
type: string
regex:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
type: object
description: withoutHeader has the same syntax with the
@@ -11762,6 +12843,9 @@ spec:
description: Timeout per attempt for a given request, including
the initial call and any retries.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
retryOn:
description: Specifies the conditions under which retry
takes place.
@@ -11788,7 +12872,7 @@ spec:
specified regex.
properties:
match:
- description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+ description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
type: string
rewrite:
description: The string that should replace into matching
@@ -11870,6 +12954,9 @@ spec:
timeout:
description: Timeout for HTTP requests, default is disabled.
type: string
+ x-kubernetes-validations:
+ - message: must be a valid duration greater than 1ms
+ rule: duration(self) >= duration('1ms')
type: object
type: array
tcp:
@@ -12183,10 +13270,20 @@ spec:
properties:
matchLabels:
additionalProperties:
+ maxLength: 63
type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: "!self.contains('*')"
description: One or more labels that indicate a specific set of
pods/VMs on which a policy should be applied.
+ maxProperties: 4096
type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains('*'))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
type: object
sha256:
description: SHA256 checksum that will be used to verify Wasm module
@@ -12197,34 +13294,68 @@ spec:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
targetRefs:
description: Optional.
items:
properties:
group:
description: group is the group of the target resource.
+ maxLength: 253
+ pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
type: string
namespace:
description: namespace is the namespace of the referent.
type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
type: object
+ x-kubernetes-validations:
+ - message: Support kinds are core/Service and gateway.networking.k8s.io/Gateway
+ rule: "[self.group, self.kind] in [['core','Service'], ['','Service'],\
+ \ ['gateway.networking.k8s.io','Gateway']]"
type: array
type:
description: |-
@@ -12242,9 +13373,9 @@ spec:
type: string
x-kubernetes-validations:
- message: url must have schema one of [http, https, file, oci]
- rule: "isURL(self) ? (url(self).getScheme() in ['', 'http', 'https',
- 'oci', 'file']) : (isURL('http://' + self) && url('http://' +self).getScheme()
- in ['', 'http', 'https', 'oci', 'file'])"
+ rule: "isURL(self) ? (url(self).getScheme() in ['', 'http', 'https',\
+ \ 'oci', 'file']) : (isURL('http://' + self) && url('http://'\
+ \ +self).getScheme() in ['', 'http', 'https', 'oci', 'file'])"
verificationKey:
type: string
vmConfig:
@@ -12278,8 +13409,8 @@ spec:
type: object
x-kubernetes-validations:
- message: value may only be set when valueFrom is INLINE
- rule: "(has(self.valueFrom) ? self.valueFrom : '') != 'HOST'
- || !has(self.value)"
+ rule: "(has(self.valueFrom) ? self.valueFrom : '') != 'HOST'\
+ \ || !has(self.value)"
maxItems: 256
type: array
x-kubernetes-list-map-keys:
@@ -12350,29 +13481,47 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) == '/'\
+ \ || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') : true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident in
the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload if a
sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -12380,9 +13529,19 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: Address is required
+ rule: has(self.address) || has(self.network)
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://')) ? !has(self.ports)\
+ \ : true"
status:
type: object
x-kubernetes-preserve-unknown-fields: true
+ required:
+ - spec
+ - spec
+ - spec
type: object
served: true
storage: false
@@ -12412,29 +13571,47 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) == '/'\
+ \ || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') : true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident in
the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload if a
sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -12442,9 +13619,19 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: Address is required
+ rule: has(self.address) || has(self.network)
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://')) ? !has(self.ports)\
+ \ : true"
status:
type: object
x-kubernetes-preserve-unknown-fields: true
+ required:
+ - spec
+ - spec
+ - spec
type: object
served: true
storage: false
@@ -12474,29 +13661,47 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) == '/'\
+ \ || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') : true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident in
the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload if a
sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -12504,9 +13709,19 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: Address is required
+ rule: has(self.address) || has(self.network)
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://')) ? !has(self.ports)\
+ \ : true"
status:
type: object
x-kubernetes-preserve-unknown-fields: true
+ required:
+ - spec
+ - spec
+ - spec
type: object
served: true
storage: true
@@ -12551,10 +13766,8 @@ spec:
openAPIV3Schema:
properties:
spec:
- description: '`WorkloadGroup` enables specifying the properties of a single
- workload for bootstrap and provides a template for `WorkloadEntry`,
- similar to how `Deployment` specifies properties of workloads via `Pod`
- templates.'
+ description: 'Describes a collection of workload instances. See more details
+ at: https://istio.io/docs/reference/config/networking/workload-group.html'
properties:
metadata:
description: Metadata that will be used for all corresponding `WorkloadEntries`.
@@ -12671,29 +13884,47 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) ==\
+ \ '/' || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') : true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident
in the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload
if a sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -12701,6 +13932,10 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://'))\
+ \ ? !has(self.ports) : true"
required:
- template
type: object
@@ -12844,29 +14079,47 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) ==\
+ \ '/' || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') : true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident
in the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload
if a sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -12874,6 +14127,10 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://'))\
+ \ ? !has(self.ports) : true"
required:
- template
type: object
@@ -12899,10 +14156,8 @@ spec:
openAPIV3Schema:
properties:
spec:
- description: '`WorkloadGroup` enables specifying the properties of a single
- workload for bootstrap and provides a template for `WorkloadEntry`,
- similar to how `Deployment` specifies properties of workloads via `Pod`
- templates.'
+ description: 'Describes a collection of workload instances. See more details
+ at: https://istio.io/docs/reference/config/networking/workload-group.html'
properties:
metadata:
description: Metadata that will be used for all corresponding `WorkloadEntries`.
@@ -13019,29 +14274,47 @@ spec:
address:
description: Address associated with the network endpoint without
the port.
+ maxLength: 256
type: string
+ x-kubernetes-validations:
+ - message: UDS must be an absolute path or abstract socket
+ rule: "self.startsWith('unix://') ? (self.substring(7,8) ==\
+ \ '/' || self.substring(7,8) == '@') : true"
+ - message: UDS may not be a dir
+ rule: "self.startsWith('unix://') ? !self.endsWith('/') : true"
labels:
additionalProperties:
type: string
description: One or more labels associated with the endpoint.
+ maxProperties: 256
type: object
locality:
description: The locality associated with the endpoint.
+ maxLength: 2048
type: string
network:
description: Network enables Istio to group endpoints resident
in the same L3 domain/network.
+ maxLength: 2048
type: string
ports:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
+ x-kubernetes-validations:
+ - message: port must be between 1-65535
+ rule: 0 < self && self <= 65535
description: Set of ports associated with the endpoint.
+ maxProperties: 128
type: object
+ x-kubernetes-validations:
+ - message: port name must be valid
+ rule: self.all(key, size(key) < 63 && key.matches('^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$'))
serviceAccount:
description: The service account associated with the workload
if a sidecar is present in the workload.
+ maxLength: 253
type: string
weight:
description: The load balancing weight associated with the endpoint.
@@ -13049,6 +14322,10 @@ spec:
minimum: 0
type: integer
type: object
+ x-kubernetes-validations:
+ - message: UDS may not include ports
+ rule: "(has(self.address) && self.address.startsWith('unix://'))\
+ \ ? !has(self.ports) : true"
required:
- template
type: object
diff --git a/common/istio-1-22/istio-crds/base/kustomization.yaml b/common/istio-1-23/istio-crds/base/kustomization.yaml
similarity index 100%
rename from common/istio-1-22/istio-crds/base/kustomization.yaml
rename to common/istio-1-23/istio-crds/base/kustomization.yaml
diff --git a/common/istio-1-22/istio-install/base/deny_all_authorizationpolicy.yaml b/common/istio-1-23/istio-install/base/deny_all_authorizationpolicy.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/deny_all_authorizationpolicy.yaml
rename to common/istio-1-23/istio-install/base/deny_all_authorizationpolicy.yaml
diff --git a/common/istio-1-22/istio-install/base/gateway.yaml b/common/istio-1-23/istio-install/base/gateway.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/gateway.yaml
rename to common/istio-1-23/istio-install/base/gateway.yaml
diff --git a/common/istio-1-22/istio-install/base/gateway_authorizationpolicy.yaml b/common/istio-1-23/istio-install/base/gateway_authorizationpolicy.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/gateway_authorizationpolicy.yaml
rename to common/istio-1-23/istio-install/base/gateway_authorizationpolicy.yaml
diff --git a/common/istio-1-22/istio-install/base/install.yaml b/common/istio-1-23/istio-install/base/install.yaml
similarity index 98%
rename from common/istio-1-22/istio-install/base/install.yaml
rename to common/istio-1-23/istio-install/base/install.yaml
index e43e9eecf0..59d77f1575 100644
--- a/common/istio-1-22/istio-install/base/install.yaml
+++ b/common/istio-1-23/istio-install/base/install.yaml
@@ -202,6 +202,16 @@ rules:
- patch
- create
- delete
+- apiGroups:
+ - networking.istio.io
+ resources:
+ - serviceentries/status
+ verbs:
+ - get
+ - watch
+ - list
+ - update
+ - patch
- apiGroups:
- apiextensions.k8s.io
resources:
@@ -424,7 +434,6 @@ metadata:
name: istio-validator-istio-system
webhooks:
- admissionReviewVersions:
- - v1beta1
- v1
clientConfig:
service:
@@ -711,6 +720,9 @@ data:
{{- if .Values.global.logAsJson }}
- --log_as_json
{{- end }}
+ {{- if .Values.global.proxy.outlierLogPath }}
+ - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+ {{- end}}
{{- if .Values.global.proxy.lifecycle }}
lifecycle:
{{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
@@ -1052,12 +1064,16 @@ data:
}
spec:
securityContext:
+ {{- if .Values.gateways.securityContext }}
+ {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+ {{- else }}
sysctls:
- name: net.ipv4.ip_unprivileged_port_start
value: "0"
+ {{- end }}
containers:
- name: istio-proxy
- {{- if contains "/" .Values.global.proxy.image }}
+ {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
{{- else }}
image: "{{ .ProxyImage }}"
@@ -1875,10 +1891,17 @@ data:
securityContext:
privileged: false
runAsGroup: 1337
- runAsUser: 0
+ runAsUser: 1337
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
capabilities:
drop:
- ALL
+ {{- if .Values.gateways.seccompProfile }}
+ seccompProfile:
+ {{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+ {{- end }}
volumeMounts:
- name: workload-socket
mountPath: /var/run/secrets/workload-spiffe-uds
@@ -1951,6 +1974,7 @@ data:
name: "{{.Name}}"
uid: "{{.UID}}"
spec:
+ ipFamilyPolicy: PreferDualStack
ports:
{{- range $key, $val := .Ports }}
- name: {{ $val.Name | quote }}
@@ -2036,12 +2060,17 @@ data:
"istio.io/gateway-name" .Name
) | nindent 8 }}
spec:
- {{- if ge .KubeVersion 122 }}
- {{/* safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326. */}}
securityContext:
+ {{- if .Values.gateways.securityContext }}
+ {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+ {{- else }}
sysctls:
- name: net.ipv4.ip_unprivileged_port_start
value: "0"
+ {{- if .Values.gateways.seccompProfile }}
+ seccompProfile:
+ {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+ {{- end }}
{{- end }}
serviceAccountName: {{.ServiceAccount | quote}}
containers:
@@ -2057,8 +2086,6 @@ data:
{{- end }}
{{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
securityContext:
- {{- if ge .KubeVersion 122 }}
- # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
capabilities:
drop:
- ALL
@@ -2068,18 +2095,6 @@ data:
runAsUser: {{ .ProxyUID | default "1337" }}
runAsGroup: {{ .ProxyGID | default "1337" }}
runAsNonRoot: true
- {{- else }}
- capabilities:
- drop:
- - ALL
- add:
- - NET_BIND_SERVICE
- runAsUser: 0
- runAsGroup: 1337
- runAsNonRoot: false
- allowPrivilegeEscalation: true
- readOnlyRootFilesystem: true
- {{- end }}
ports:
- containerPort: 15021
name: status-port
@@ -2320,6 +2335,10 @@ data:
---
values: |-
{
+ "gateways": {
+ "seccompProfile": {},
+ "securityContext": {}
+ },
"global": {
"autoscalingv2API": true,
"caAddress": "",
@@ -2374,6 +2393,7 @@ data:
"includeInboundPorts": "*",
"includeOutboundPorts": "",
"logLevel": "warning",
+ "outlierLogPath": "",
"privileged": false,
"readinessFailureThreshold": 4,
"readinessInitialDelaySeconds": 0,
@@ -2407,7 +2427,7 @@ data:
"sts": {
"servicePort": 0
},
- "tag": "1.22.1",
+ "tag": "1.23.2",
"variant": ""
},
"istio_cni": {
@@ -2455,7 +2475,6 @@ metadata:
name: istio-sidecar-injector
webhooks:
- admissionReviewVersions:
- - v1beta1
- v1
clientConfig:
service:
@@ -2491,7 +2510,6 @@ webhooks:
- pods
sideEffects: None
- admissionReviewVersions:
- - v1beta1
- v1
clientConfig:
service:
@@ -2529,7 +2547,6 @@ webhooks:
- pods
sideEffects: None
- admissionReviewVersions:
- - v1beta1
- v1
clientConfig:
service:
@@ -2563,7 +2580,6 @@ webhooks:
- pods
sideEffects: None
- admissionReviewVersions:
- - v1beta1
- v1
clientConfig:
service:
@@ -2695,8 +2711,7 @@ spec:
- name: ISTIO_META_WORKLOAD_NAME
value: istio-ingressgateway
- name: ISTIO_META_OWNER
- value:
- kubernetes://apis/apps/v1/namespaces/istio-system/deployments/istio-ingressgateway
+ value: kubernetes://apis/apps/v1/namespaces/istio-system/deployments/istio-ingressgateway
- name: ISTIO_META_MESH_ID
value: cluster.local
- name: TRUST_DOMAIN
@@ -2709,7 +2724,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- image: docker.io/istio/proxyv2:1.22.1
+ image: docker.io/istio/proxyv2:1.23.2
name: istio-proxy
ports:
- containerPort: 15021
@@ -2885,6 +2900,8 @@ spec:
fieldPath: spec.serviceAccountName
- name: KUBECONFIG
value: /var/run/secrets/remote/config
+ - name: CA_TRUSTED_NODE_ACCOUNTS
+ value: istio-system/ztunnel
- name: PILOT_TRACE_SAMPLING
value: '1'
- name: PILOT_ENABLE_ANALYSIS
@@ -2901,7 +2918,7 @@ spec:
resource: limits.cpu
- name: PLATFORM
value: ''
- image: docker.io/istio/pilot:1.22.1
+ image: docker.io/istio/pilot:1.23.2
name: discovery
ports:
- containerPort: 8080
diff --git a/common/istio-1-22/istio-install/base/kustomization.yaml b/common/istio-1-23/istio-install/base/kustomization.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/kustomization.yaml
rename to common/istio-1-23/istio-install/base/kustomization.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/disable-debugging.yaml b/common/istio-1-23/istio-install/base/patches/disable-debugging.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/disable-debugging.yaml
rename to common/istio-1-23/istio-install/base/patches/disable-debugging.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/istio-configmap-disable-tracing.yaml b/common/istio-1-23/istio-install/base/patches/istio-configmap-disable-tracing.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/istio-configmap-disable-tracing.yaml
rename to common/istio-1-23/istio-install/base/patches/istio-configmap-disable-tracing.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/istio-ingressgateway-remove-pdb.yaml b/common/istio-1-23/istio-install/base/patches/istio-ingressgateway-remove-pdb.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/istio-ingressgateway-remove-pdb.yaml
rename to common/istio-1-23/istio-install/base/patches/istio-ingressgateway-remove-pdb.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/istiod-remove-pdb.yaml b/common/istio-1-23/istio-install/base/patches/istiod-remove-pdb.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/istiod-remove-pdb.yaml
rename to common/istio-1-23/istio-install/base/patches/istiod-remove-pdb.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/seccomp-istio-ingressgateway.yaml b/common/istio-1-23/istio-install/base/patches/seccomp-istio-ingressgateway.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/seccomp-istio-ingressgateway.yaml
rename to common/istio-1-23/istio-install/base/patches/seccomp-istio-ingressgateway.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/seccomp-istiod.yaml b/common/istio-1-23/istio-install/base/patches/seccomp-istiod.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/seccomp-istiod.yaml
rename to common/istio-1-23/istio-install/base/patches/seccomp-istiod.yaml
diff --git a/common/istio-1-22/istio-install/base/patches/service.yaml b/common/istio-1-23/istio-install/base/patches/service.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/base/patches/service.yaml
rename to common/istio-1-23/istio-install/base/patches/service.yaml
diff --git a/common/istio-1-22/istio-install/overlays/oauth2-proxy/kustomization.yaml b/common/istio-1-23/istio-install/overlays/oauth2-proxy/kustomization.yaml
similarity index 100%
rename from common/istio-1-22/istio-install/overlays/oauth2-proxy/kustomization.yaml
rename to common/istio-1-23/istio-install/overlays/oauth2-proxy/kustomization.yaml
diff --git a/common/istio-1-22/istio-namespace/base/kustomization.yaml b/common/istio-1-23/istio-namespace/base/kustomization.yaml
similarity index 100%
rename from common/istio-1-22/istio-namespace/base/kustomization.yaml
rename to common/istio-1-23/istio-namespace/base/kustomization.yaml
diff --git a/common/istio-1-22/istio-namespace/base/namespace.yaml b/common/istio-1-23/istio-namespace/base/namespace.yaml
similarity index 100%
rename from common/istio-1-22/istio-namespace/base/namespace.yaml
rename to common/istio-1-23/istio-namespace/base/namespace.yaml
diff --git a/common/istio-1-22/kubeflow-istio-resources/base/cluster-roles.yaml b/common/istio-1-23/kubeflow-istio-resources/base/cluster-roles.yaml
similarity index 100%
rename from common/istio-1-22/kubeflow-istio-resources/base/cluster-roles.yaml
rename to common/istio-1-23/kubeflow-istio-resources/base/cluster-roles.yaml
diff --git a/common/istio-1-22/kubeflow-istio-resources/base/kf-istio-resources.yaml b/common/istio-1-23/kubeflow-istio-resources/base/kf-istio-resources.yaml
similarity index 100%
rename from common/istio-1-22/kubeflow-istio-resources/base/kf-istio-resources.yaml
rename to common/istio-1-23/kubeflow-istio-resources/base/kf-istio-resources.yaml
diff --git a/common/istio-1-22/kubeflow-istio-resources/base/kustomization.yaml b/common/istio-1-23/kubeflow-istio-resources/base/kustomization.yaml
similarity index 100%
rename from common/istio-1-22/kubeflow-istio-resources/base/kustomization.yaml
rename to common/istio-1-23/kubeflow-istio-resources/base/kustomization.yaml
diff --git a/common/istio-1-22/profile-overlay.yaml b/common/istio-1-23/profile-overlay.yaml
similarity index 100%
rename from common/istio-1-22/profile-overlay.yaml
rename to common/istio-1-23/profile-overlay.yaml
diff --git a/common/istio-1-22/profile.yaml b/common/istio-1-23/profile.yaml
similarity index 97%
rename from common/istio-1-22/profile.yaml
rename to common/istio-1-23/profile.yaml
index 7d6ef09cb6..077b0c86d2 100644
--- a/common/istio-1-22/profile.yaml
+++ b/common/istio-1-23/profile.yaml
@@ -14,7 +14,7 @@ spec:
enabled: true
hub: docker.io/istio
profile: default
- tag: 1.22.1
+ tag: 1.23.2
values:
defaultRevision: ""
gateways:
diff --git a/common/istio-1-22/split-istio-packages b/common/istio-1-23/split-istio-packages
similarity index 100%
rename from common/istio-1-22/split-istio-packages
rename to common/istio-1-23/split-istio-packages
diff --git a/common/oauth2-proxy/components/README.md b/common/oauth2-proxy/components/README.md
index d44bb35fce..8332d6d5ec 100644
--- a/common/oauth2-proxy/components/README.md
+++ b/common/oauth2-proxy/components/README.md
@@ -154,9 +154,9 @@ make the following changes to the `example/kustomization.yaml` file:
* use `oauth2-proxy` overlay for istio-install
```
# from
- - ../common/istio-1-22/istio-install/base
+ - ../common/istio-1-23/istio-install/base
# to
- - ../common/istio-1-22/istio-install/overlays/oauth2-proxy
+ - ../common/istio-1-23/istio-install/overlays/oauth2-proxy
```
* change `OIDC Authservice` to `oauth2-proxy for OIDC` and use overlay for m2m
bearer tokens with self-signed in-cluster issuer
@@ -189,12 +189,12 @@ index c1a85789..4a50440c 100644
+++ b/example/kustomization.yaml
@@ -38,11 +38,11 @@ resources:
# Istio
- - ../common/istio-1-22/istio-crds/base
- - ../common/istio-1-22/istio-namespace/base
--- ../common/istio-1-22/istio-install/base
+ - ../common/istio-1-23/istio-crds/base
+ - ../common/istio-1-23/istio-namespace/base
+-- ../common/istio-1-23/istio-install/base
-# OIDC Authservice
-- ../common//oidc-authservice/base
-+- ../common/istio-1-22/istio-install/overlays/oauth2-proxy
++- ../common/istio-1-23/istio-install/overlays/oauth2-proxy
+# oauth2-proxy for OIDC
+- ../common/oauth2-proxy/overlays/m2m-dex-and-kind
# Dex
diff --git a/contrib/kserve/README.md b/contrib/kserve/README.md
index 671dd70733..250480c0e2 100644
--- a/contrib/kserve/README.md
+++ b/contrib/kserve/README.md
@@ -61,15 +61,15 @@ For upgrading see [UPGRADE.md](UPGRADE.md)
```
5. Install Istio
```sh
- kubectl apply -k ../../common/istio-1-22/istio-crds/base
- kubectl apply -k ../../common/istio-1-22/istio-namespace/base
- kubectl apply -k ../../common/istio-1-22/istio-install/base
+ kubectl apply -k ../../common/istio-1-23/istio-crds/base
+ kubectl apply -k ../../common/istio-1-23/istio-namespace/base
+ kubectl apply -k ../../common/istio-1-23/istio-install/base
```
6. Install knative
```sh
kubectl apply -k ../../common/knative/knative-serving/overlays/gateways
- kubectl apply -k ../../common/istio-1-22/cluster-local-gateway/base
- kubectl apply -k ../../common/istio-1-22/kubeflow-istio-resources/base
+ kubectl apply -k ../../common/istio-1-23/cluster-local-gateway/base
+ kubectl apply -k ../../common/istio-1-23/kubeflow-istio-resources/base
```
7. Install kserve
```sh
diff --git a/example/kustomization.yaml b/example/kustomization.yaml
index f553452b06..2c0e243274 100644
--- a/example/kustomization.yaml
+++ b/example/kustomization.yaml
@@ -37,9 +37,9 @@ resources:
- ../common/cert-manager/cert-manager/base
- ../common/cert-manager/kubeflow-issuer/base
# Istio
-- ../common/istio-1-22/istio-crds/base
-- ../common/istio-1-22/istio-namespace/base
-- ../common/istio-1-22/istio-install/overlays/oauth2-proxy
+- ../common/istio-1-23/istio-crds/base
+- ../common/istio-1-23/istio-namespace/base
+- ../common/istio-1-23/istio-install/overlays/oauth2-proxy
# oauth2-proxy
# NOTE: only uncomment ONE of the following overlays, depending on your cluster type
- ../common/oauth2-proxy/overlays/m2m-dex-only # for all clusters
@@ -52,7 +52,7 @@ resources:
- ../common/knative/knative-serving/overlays/gateways
# Uncomment the following line if `knative-eventing` is required
# - ../common/knative/knative-eventing/base
-- ../common/istio-1-22/cluster-local-gateway/base
+- ../common/istio-1-23/cluster-local-gateway/base
# Kubeflow namespace
- ../common/kubeflow-namespace/base
# NetworkPolicies
@@ -60,7 +60,7 @@ resources:
# Kubeflow Roles
- ../common/kubeflow-roles/base
# Kubeflow Istio Resources
-- ../common/istio-1-22/kubeflow-istio-resources/base
+- ../common/istio-1-23/kubeflow-istio-resources/base
# Kubeflow Pipelines
diff --git a/hack/synchronize-istio-manifests.sh b/hack/synchronize-istio-manifests.sh
index ad75d68022..e2e1e97629 100755
--- a/hack/synchronize-istio-manifests.sh
+++ b/hack/synchronize-istio-manifests.sh
@@ -15,9 +15,9 @@
set -euxo pipefail
IFS=$'\n\t'
-COMMIT="1.22.1"
-CURRENT_VERSION="1-21"
-NEW_VERSION="1-22" # Must be a release
+COMMIT="1.23.2"
+CURRENT_VERSION="1-22"
+NEW_VERSION="1-23" # Must be a release
SRC_DIR=${SRC_DIR:=/tmp/istio} # Must be a release
BRANCH=${BRANCH:=istio-${COMMIT?}}
diff --git a/hack/trivy_scan.py b/hack/trivy_scan.py
index 3e2213eaa5..b93334156e 100755
--- a/hack/trivy_scan.py
+++ b/hack/trivy_scan.py
@@ -34,7 +34,7 @@
"automl": "../apps/katib/upstream/installs",
"pipelines": "../apps/pipeline/upstream/env ../apps/kfp-tekton/upstream/env",
"training": "../apps/training-operator/upstream/overlays",
- "manifests": "../common/cert-manager/cert-manager/base ../common/cert-manager/kubeflow-issuer/base ../common/istio-1-22/istio-crds/base ../common/istio-1-22/istio-namespace/base ../common/istio-1-22/istio-install/overlays/oauth2-proxy ../common/oauth2-proxy/overlays/m2m-self-signed ../common/dex/overlays/oauth2-proxy ../common/knative/knative-serving/overlays/gateways ../common/knative/knative-eventing/base ../common/istio-1-22/cluster-local-gateway/base ../common/kubeflow-namespace/base ../common/kubeflow-roles/base ../common/istio-1-22/kubeflow-istio-resources/base",
+ "manifests": "../common/cert-manager/cert-manager/base ../common/cert-manager/kubeflow-issuer/base ../common/istio-1-23/istio-crds/base ../common/istio-1-23/istio-namespace/base ../common/istio-1-23/istio-install/overlays/oauth2-proxy ../common/oauth2-proxy/overlays/m2m-self-signed ../common/dex/overlays/oauth2-proxy ../common/knative/knative-serving/overlays/gateways ../common/knative/knative-eventing/base ../common/istio-1-23/cluster-local-gateway/base ../common/kubeflow-namespace/base ../common/kubeflow-roles/base ../common/istio-1-23/kubeflow-istio-resources/base",
"workbenches": "../apps/pvcviewer-controller/upstream/base ../apps/admission-webhook/upstream/overlays ../apps/centraldashboard/overlays ../apps/jupyter/jupyter-web-app/upstream/overlays ../apps/volumes-web-app/upstream/overlays ../apps/tensorboard/tensorboards-web-app/upstream/overlays ../apps/profiles/upstream/overlays ../apps/jupyter/notebook-controller/upstream/overlays ../apps/tensorboard/tensorboard-controller/upstream/overlays",
"serving": "../contrib/kserve - ../contrib/kserve/models-web-app/overlays/kubeflow",
"model-registry": "../apps/model-registry/upstream",
diff --git a/tests/gh-actions/deploy-dex-login-environment/kustomization.yaml b/tests/gh-actions/deploy-dex-login-environment/kustomization.yaml
index 0da06749e5..3d34b0f0ab 100644
--- a/tests/gh-actions/deploy-dex-login-environment/kustomization.yaml
+++ b/tests/gh-actions/deploy-dex-login-environment/kustomization.yaml
@@ -34,14 +34,14 @@ sortOptions:
resources:
# Istio
-- ../../../common/istio-1-22/istio-crds/base
-- ../../../common/istio-1-22/istio-namespace/base
-- ../../../common/istio-1-22/istio-install/overlays/oauth2-proxy
+- ../../../common/istio-1-23/istio-crds/base
+- ../../../common/istio-1-23/istio-namespace/base
+- ../../../common/istio-1-23/istio-install/overlays/oauth2-proxy
# oauth2-proxy
- ../../../common/oauth2-proxy/overlays/m2m-dex-and-kind
# Dex
- ../../../common/dex/overlays/oauth2-proxy
-- ../../../common/istio-1-22/cluster-local-gateway/base
+- ../../../common/istio-1-23/cluster-local-gateway/base
# Kubeflow namespace
- ../../../common/kubeflow-namespace/base
# NetworkPolicies
@@ -49,7 +49,7 @@ resources:
# Kubeflow Roles
- ../../../common/kubeflow-roles/base
# Kubeflow Istio Resources
-- ../../../common/istio-1-22/kubeflow-istio-resources/base
+- ../../../common/istio-1-23/kubeflow-istio-resources/base
# Central Dashboard
- ../../../apps/centraldashboard/overlays/oauth2-proxy
# Profiles + KFAM
diff --git a/tests/gh-actions/install_istio.sh b/tests/gh-actions/install_istio.sh
index 6af5b748d4..5d8e66d427 100755
--- a/tests/gh-actions/install_istio.sh
+++ b/tests/gh-actions/install_istio.sh
@@ -1,7 +1,7 @@
#!/bin/bash
set -e
echo "Installing Istio (with ExtAuthZ from oauth2-proxy) ..."
-cd common/istio-1-22
+cd common/istio-1-23
kustomize build istio-crds/base | kubectl apply -f -
kustomize build istio-namespace/base | kubectl apply -f -
kustomize build istio-install/overlays/oauth2-proxy | kubectl apply -f -
diff --git a/tests/gh-actions/install_knative.sh b/tests/gh-actions/install_knative.sh
index 70fe05b42e..c9b04b36cb 100755
--- a/tests/gh-actions/install_knative.sh
+++ b/tests/gh-actions/install_knative.sh
@@ -6,8 +6,8 @@ kustomize build common/knative/knative-serving/base | kubectl apply -f -
set -e
kustomize build common/knative/knative-serving/base | kubectl apply -f -
-kustomize build common/istio-1-22/cluster-local-gateway/base | kubectl apply -f -
-kustomize build common/istio-1-22/kubeflow-istio-resources/base | kubectl apply -f -
+kustomize build common/istio-1-23/cluster-local-gateway/base | kubectl apply -f -
+kustomize build common/istio-1-23/kubeflow-istio-resources/base | kubectl apply -f -
kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=600s \
--field-selector=status.phase!=Succeeded