@ -5,7 +5,6 @@ package envoy.api.v2.route;
option java_outer_classname = "RouteProto" ;
option java_multiple_files = true ;
option java_package = "io.envoyproxy.envoy.api.v2.route" ;
option java_generic_services = true ;
import "envoy/api/v2/core/base.proto" ;
import "envoy/type/matcher/regex.proto" ;
@ -31,9 +30,24 @@ import "validate/validate.proto";
/ / upstream cluster to route to or whether to perform a redirect.
/ / [ # comment : next free field : 17 ]
message VirtualHost {
enum TlsRequirementType {
/ / No TLS requirement for the virtual host.
NONE = 0 ;
/ / External requests must use TLS. If a request is external and it is not
/ / using TLS , a 301 redirect will be sent telling the client to use HTTPS.
EXTERNAL_ONLY = 1 ;
/ / All requests must use TLS. If a request is not using TLS , a 301 redirect
/ / will be sent telling the client to use HTTPS.
ALL = 2 ;
}
reserved 9 ;
/ / The logical name of the virtual host. This is used when emitting certain
/ / statistics but is not relevant for routing.
string name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / A list of domains ( host / authority header ) that will be matched to this
/ / virtual host. Wildcard hosts are supported in the suffix or prefix form.
@ -51,25 +65,12 @@ message VirtualHost {
/ / The longest wildcards match first.
/ / Only a single virtual host in the entire route configuration can match on ` ` * ` ` . A domain
/ / must be unique across all virtual hosts or the config will fail to load.
repeated string domains = 2 [ ( validate.rules ) . repeated . min_items = 1 ] ;
repeated string domains = 2 [ ( validate.rules ) . repeated = { min_items : 1 } ] ;
/ / The list of routes that will be matched , in order , for incoming requests.
/ / The first route that matches will be used.
repeated Route routes = 3 ;
enum TlsRequirementType {
/ / No TLS requirement for the virtual host.
NONE = 0 ;
/ / External requests must use TLS. If a request is external and it is not
/ / using TLS , a 301 redirect will be sent telling the client to use HTTPS.
EXTERNAL_ONLY = 1 ;
/ / All requests must use TLS. If a request is not using TLS , a 301 redirect
/ / will be sent telling the client to use HTTPS.
ALL = 2 ;
}
/ / Specifies the type of TLS enforcement the virtual host expects. If this option is not
/ / specified , there is no TLS requirement for the virtual host.
TlsRequirementType require_tls = 4 ;
@ -89,7 +90,7 @@ message VirtualHost {
/ / details on header value syntax , see the documentation on : ref : ` custom request headers
/ / < config_http_conn_man_headers_custom_request_headers > ` .
repeated core.HeaderValueOption request_headers_to_add = 7
[ ( validate.rules ) . repeated . max_items = 1000 ] ;
[ ( validate.rules ) . repeated = { max_items : 1000 } ] ;
/ / Specifies a list of HTTP headers that should be removed from each request
/ / handled by this virtual host.
@ -102,7 +103,7 @@ message VirtualHost {
/ / details on header value syntax , see the documentation on : ref : ` custom request headers
/ / < config_http_conn_man_headers_custom_request_headers > ` .
repeated core.HeaderValueOption response_headers_to_add = 10
[ ( validate.rules ) . repeated . max_items = 1000 ] ;
[ ( validate.rules ) . repeated = { max_items : 1000 } ] ;
/ / Specifies a list of HTTP headers that should be removed from each response
/ / handled by this virtual host.
@ -111,8 +112,6 @@ message VirtualHost {
/ / Indicates that the virtual host has a CORS policy.
CorsPolicy cors = 8 ;
reserved 9 ;
/ / The per_filter_config field can be used to provide virtual host - specific
/ / configurations for filters. The key should match the filter name , such as
/ / * envoy.buffer * for the HTTP buffer filter. Use of this field is filter
@ -157,11 +156,13 @@ message VirtualHost {
/ / < envoy_api_msg_route.HeaderMatcher > ` .
/ / [ # comment : next free field : 15 ]
message Route {
reserved 6 ;
/ / Name for the route.
string name = 14 ;
/ / Route matching parameters.
RouteMatch match = 1 [ ( validate.rules ) . message.required = true ] ;
RouteMatch match = 1 [ ( validate.rules ) . message = { required : true } ] ;
oneof action {
option ( validate.required ) = true ;
@ -186,8 +187,6 @@ message Route {
/ / Decorator for the matched route.
Decorator decorator = 5 ;
reserved 6 ;
/ / The per_filter_config field can be used to provide route - specific
/ / configurations for filters. The key should match the filter name , such as
/ / * envoy.buffer * for the HTTP buffer filter. Use of this field is filter
@ -209,7 +208,7 @@ message Route {
/ / header value syntax , see the documentation on : ref : ` custom request headers
/ / < config_http_conn_man_headers_custom_request_headers > ` .
repeated core.HeaderValueOption request_headers_to_add = 9
[ ( validate.rules ) . repeated . max_items = 1000 ] ;
[ ( validate.rules ) . repeated = { max_items : 1000 } ] ;
/ / Specifies a list of HTTP headers that should be removed from each request
/ / matching this route.
@ -222,7 +221,7 @@ message Route {
/ / details on header value syntax , see the documentation on
/ / : ref : ` custom request headers < config_http_conn_man_headers_custom_request_headers > ` .
repeated core.HeaderValueOption response_headers_to_add = 10
[ ( validate.rules ) . repeated . max_items = 1000 ] ;
[ ( validate.rules ) . repeated = { max_items : 1000 } ] ;
/ / Specifies a list of HTTP headers that should be removed from each response
/ / to requests matching this route.
@ -242,9 +241,11 @@ message Route {
/ / [ # comment : next free field : 11 ]
message WeightedCluster {
message ClusterWeight {
reserved 7 ;
/ / Name of the upstream cluster. The cluster must exist in the
/ / : ref : ` cluster manager configuration < config_cluster_manager > ` .
string name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / An integer between 0 and : ref : ` total_weight
/ / < envoy_api_field_route.WeightedCluster.total_weight > ` . When a request matches the route ,
@ -267,7 +268,7 @@ message WeightedCluster {
/ / header value syntax , see the documentation on : ref : ` custom request headers
/ / < config_http_conn_man_headers_custom_request_headers > ` .
repeated core.HeaderValueOption request_headers_to_add = 4
[ ( validate.rules ) . repeated . max_items = 1000 ] ;
[ ( validate.rules ) . repeated = { max_items : 1000 } ] ;
/ / Specifies a list of HTTP headers that should be removed from each request when
/ / this cluster is selected through the enclosing : ref : ` envoy_api_msg_route.RouteAction ` .
@ -281,14 +282,12 @@ message WeightedCluster {
/ / header value syntax , see the documentation on : ref : ` custom request headers
/ / < config_http_conn_man_headers_custom_request_headers > ` .
repeated core.HeaderValueOption response_headers_to_add = 5
[ ( validate.rules ) . repeated . max_items = 1000 ] ;
[ ( validate.rules ) . repeated = { max_items : 1000 } ] ;
/ / Specifies a list of headers to be removed from responses when this cluster is selected
/ / through the enclosing : ref : ` envoy_api_msg_route.RouteAction ` .
repeated string response_headers_to_remove = 6 ;
reserved 7 ;
/ / The per_filter_config field can be used to provide weighted cluster - specific
/ / configurations for filters. The key should match the filter name , such as
/ / * envoy.buffer * for the HTTP buffer filter. Use of this field is filter
@ -305,11 +304,11 @@ message WeightedCluster {
}
/ / Specifies one or more upstream clusters associated with the route.
repeated ClusterWeight clusters = 1 [ ( validate.rules ) . repeated . min_items = 1 ] ;
repeated ClusterWeight clusters = 1 [ ( validate.rules ) . repeated = { min_items : 1 } ] ;
/ / Specifies the total weight across all clusters. The sum of all cluster weights must equal this
/ / value , which must be greater than 0. Defaults to 100.
google.protobuf.UInt32Value total_weight = 3 [ ( validate.rules ) . uint32 . gte = 1 ] ;
google.protobuf.UInt32Value total_weight = 3 [ ( validate.rules ) . uint32 = { gte : 1 } ] ;
/ / Specifies the runtime key prefix that should be used to construct the
/ / runtime keys associated with each cluster. When the * runtime_key_prefix * is
@ -323,6 +322,11 @@ message WeightedCluster {
}
message RouteMatch {
message GrpcRouteMatchOptions {
}
reserved 5 ;
oneof path_specifier {
option ( validate.required ) = true ;
@ -350,7 +354,7 @@ message RouteMatch {
/ / . . attention : :
/ / This field has been deprecated in favor of ` safe_regex ` as it is not safe for use with
/ / untrusted input in all cases.
string regex = 3 [ ( validate.rules ) . string . max_bytes = 1024 , deprecated = true ] ;
string regex = 3 [ ( validate.rules ) . string = { max_bytes : 1024 } , deprecated = true ] ;
/ / If specified , the route is a regular expression rule meaning that the
/ / regex must match the * : path * header once the query string is removed. The entire path
@ -364,15 +368,13 @@ message RouteMatch {
/ / path_specifier entirely and just rely on a set of header matchers which can already match
/ / on : path , etc. The issue with that is it is unclear how to generically deal with query string
/ / stripping. This needs more thought. ]
type.matcher.RegexMatcher safe_regex = 10 [ ( validate.rules ) . message.required = true ] ;
type.matcher.RegexMatcher safe_regex = 10 [ ( validate.rules ) . message = { required : true } ] ;
}
/ / Indicates that prefix / path matching should be case insensitive. The default
/ / is true .
google.protobuf.BoolValue case_sensitive = 4 ;
reserved 5 ;
/ / Indicates that the route should additionally match on a runtime key. Every time the route
/ / is considered for a match , it must also fall under the percentage of matches indicated by
/ / this field. For some fraction N / D , a random number in the range [ 0 , D ) is selected. If the
@ -405,9 +407,6 @@ message RouteMatch {
/ / query string for a match to occur.
repeated QueryParameterMatcher query_parameters = 7 ;
message GrpcRouteMatchOptions {
}
/ / If specified , only gRPC requests will be matched. The router will check
/ / that the content - type header has a application / grpc or one of the various
/ / application / grpc + values.
@ -432,7 +431,7 @@ message CorsPolicy {
/ / This field has been deprecated in favor of ` allow_origin_string_match ` as it is not safe for
/ / use with untrusted input in all cases.
repeated string allow_origin_regex = 8
[ ( validate.rules ) . repeated . items.string.max_bytes = 1024 , deprecated = true ] ;
[ ( validate.rules ) . repeated = { items { string { max_bytes : 1024 } } } , deprecated = true ] ;
/ / Specifies string patterns that match allowed origins. An origin is allowed if any of the
/ / string matchers match.
@ -489,12 +488,173 @@ message CorsPolicy {
/ / [ # comment : next free field : 30 ]
message RouteAction {
enum ClusterNotFoundResponseCode {
/ / HTTP status code - 503 Service Unavailable.
SERVICE_UNAVAILABLE = 0 ;
/ / HTTP status code - 404 Not Found.
NOT_FOUND = 1 ;
}
/ / Configures : ref : ` internal redirect < arch_overview_internal_redirects > ` behavior.
enum InternalRedirectAction {
PASS_THROUGH_INTERNAL_REDIRECT = 0 ;
HANDLE_INTERNAL_REDIRECT = 1 ;
}
/ / The router is capable of shadowing traffic from one cluster to another. The current
/ / implementation is "fire and forget," meaning Envoy will not wait for the shadow cluster to
/ / respond before returning the response from the primary cluster. All normal statistics are
/ / collected for the shadow cluster making this feature useful for testing.
/ /
/ / During shadowing , the host / authority header is altered such that * - shadow * is appended. This is
/ / useful for logging. For example , * cluster1 * becomes * cluster1 - shadow * .
message RequestMirrorPolicy {
/ / Specifies the cluster that requests will be mirrored to . The cluster must
/ / exist in the cluster manager configuration.
string cluster = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / If not specified , all requests to the target cluster will be mirrored. If
/ / specified , Envoy will lookup the runtime key to get the % of requests to
/ / mirror. Valid values are from 0 to 10000 , allowing for increments of
/ / 0.01 % of requests to be mirrored. If the runtime key is specified in the
/ / configuration but not present in runtime , 0 is the default and thus 0 % of
/ / requests will be mirrored.
/ /
/ / . . attention : :
/ /
/ / * * This field is deprecated * * . Set the
/ / : ref : ` runtime_fraction
/ / < envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_fraction > ` field instead.
string runtime_key = 2 [ deprecated = true ] ;
/ / If both : ref : ` runtime_key
/ / < envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_key > ` and this field are not
/ / specified , all requests to the target cluster will be mirrored.
/ /
/ / If specified , this field takes precedence over the ` runtime_key ` field and requests must also
/ / fall under the percentage of matches indicated by this field.
/ /
/ / For some fraction N / D , a random number in the range [ 0 , D ) is selected. If the
/ / number is < = the value of the numerator N , or if the key is not present , the default
/ / value , the request will be mirrored.
/ /
/ / . . note : :
/ /
/ / Parsing this field is implemented such that the runtime key ' s data may be represented
/ / as a : ref : ` FractionalPercent < envoy_api_msg_type.FractionalPercent > ` proto represented
/ / as JSON / YAML and may also be represented as an integer with the assumption that the value
/ / is an integral percentage out of 100. For instance , a runtime key lookup returning the
/ / value "42" would parse as a ` FractionalPercent ` whose numerator is 42 and denominator is
/ / HUNDRED. This is behaviour is different to that of the deprecated ` runtime_key ` field ,
/ / where the implicit denominator is 10000.
core.RuntimeFractionalPercent runtime_fraction = 3 ;
}
/ / Specifies the route ' s hashing policy if the upstream cluster uses a hashing : ref : ` load balancer
/ / < arch_overview_load_balancing_types > ` .
message HashPolicy {
message Header {
/ / The name of the request header that will be used to obtain the hash
/ / key. If the request header is not present , no hash will be produced.
string header_name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
}
/ / Envoy supports two types of cookie affinity :
/ /
/ / 1. Passive. Envoy takes a cookie that ' s present in the cookies header and
/ / hashes on its value.
/ /
/ / 2. Generated. Envoy generates and sets a cookie with an expiration ( TTL )
/ / on the first request from the client in its response to the client ,
/ / based on the endpoint the request gets sent to . The client then
/ / presents this on the next and all subsequent requests. The hash of
/ / this is sufficient to ensure these requests get sent to the same
/ / endpoint. The cookie is generated by hashing the source and
/ / destination ports and addresses so that multiple independent HTTP2
/ / streams on the same connection will independently receive the same
/ / cookie , even if they arrive at the Envoy simultaneously.
message Cookie {
/ / The name of the cookie that will be used to obtain the hash key. If the
/ / cookie is not present and ttl below is not set , no hash will be
/ / produced.
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / If specified , a cookie with the TTL will be generated if the cookie is
/ / not present. If the TTL is present and zero , the generated cookie will
/ / be a session cookie.
google.protobuf.Duration ttl = 2 ;
/ / The name of the path for the cookie. If no path is specified here , no path
/ / will be set for the cookie.
string path = 3 ;
}
message ConnectionProperties {
/ / Hash on source IP address.
bool source_ip = 1 ;
}
oneof policy_specifier {
option ( validate.required ) = true ;
/ / Header hash policy.
Header header = 1 ;
/ / Cookie hash policy.
Cookie cookie = 2 ;
/ / Connection properties hash policy.
ConnectionProperties connection_properties = 3 ;
}
/ / The flag that shortcircuits the hash computing. This field provides a
/ / 'fallback' style of configuration : " if a terminal policy doesn ' t work ,
/ / fallback to rest of the policy list " , it saves time when the terminal
/ / policy works.
/ /
/ / If true , and there is already a hash computed , ignore rest of the
/ / list of hash polices.
/ / For example , if the following hash methods are configured :
/ /
/ / = = = = = = = = = = = = = = = = =
/ / specifier terminal
/ / = = = = = = = = = = = = = = = = =
/ / Header A true
/ / Header B false
/ / Header C false
/ / = = = = = = = = = = = = = = = = =
/ /
/ / The generateHash process ends if policy "header A" generates a hash , as
/ / it ' s a terminal policy.
bool terminal = 4 ;
}
/ / Allows enabling and disabling upgrades on a per - route basis.
/ / This overrides any enabled / disabled upgrade filter chain specified in the
/ / HttpConnectionManager
/ / : ref : upgrade_configs `
/ / < envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.upgrade_configs > `
/ / but does not affect any custom filter chain specified there.
message UpgradeConfig {
/ / The case - insensitive name of this upgrade , e.g. "websocket" .
/ / For each upgrade type present in upgrade_configs , requests with
/ / Upgrade : [ upgrade_type ] will be proxied upstream.
string upgrade_type = 1 ;
/ / Determines if upgrades are available on this route. Defaults to true .
google.protobuf.BoolValue enabled = 2 ;
}
reserved 12 , 18 , 19 , 16 , 22 , 21 ;
oneof cluster_specifier {
option ( validate.required ) = true ;
/ / Indicates the upstream cluster to which the request should be routed
/ / to .
string cluster = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string cluster = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / Envoy will determine the cluster to route to by reading the value of the
/ / HTTP header named by cluster_header from the request headers. If the
@ -505,7 +665,7 @@ message RouteAction {
/ /
/ / Internally , Envoy always uses the HTTP / 2 * : authority * header to represent the HTTP / 1
/ / * Host * header. Thus , if attempting to match on * Host * , match on * : authority * instead.
string cluster_header = 2 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string cluster_header = 2 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / Multiple upstream clusters can be specified for a given route. The
/ / request is routed to one of the upstream clusters based on weights
@ -515,18 +675,10 @@ message RouteAction {
WeightedCluster weighted_clusters = 3 ;
}
enum ClusterNotFoundResponseCode {
/ / HTTP status code - 503 Service Unavailable.
SERVICE_UNAVAILABLE = 0 ;
/ / HTTP status code - 404 Not Found.
NOT_FOUND = 1 ;
}
/ / The HTTP status code to use when configured cluster is not found.
/ / The default response code is 503 Service Unavailable.
ClusterNotFoundResponseCode cluster_not_found_response_code = 20
[ ( validate.rules ) . enum.defined_only = true ] ;
[ ( validate.rules ) . enum = { defined_only : true } ] ;
/ / Optional endpoint metadata match criteria used by the subset load balancer. Only endpoints
/ / in the upstream cluster with metadata matching what ' s set in this field will be considered
@ -625,55 +777,6 @@ message RouteAction {
/ / ( e.g. : policies are not merged , most internal one becomes the enforced policy ) .
RetryPolicy retry_policy = 9 ;
/ / The router is capable of shadowing traffic from one cluster to another. The current
/ / implementation is "fire and forget," meaning Envoy will not wait for the shadow cluster to
/ / respond before returning the response from the primary cluster. All normal statistics are
/ / collected for the shadow cluster making this feature useful for testing.
/ /
/ / During shadowing , the host / authority header is altered such that * - shadow * is appended. This is
/ / useful for logging. For example , * cluster1 * becomes * cluster1 - shadow * .
message RequestMirrorPolicy {
/ / Specifies the cluster that requests will be mirrored to . The cluster must
/ / exist in the cluster manager configuration.
string cluster = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
/ / If not specified , all requests to the target cluster will be mirrored. If
/ / specified , Envoy will lookup the runtime key to get the % of requests to
/ / mirror. Valid values are from 0 to 10000 , allowing for increments of
/ / 0.01 % of requests to be mirrored. If the runtime key is specified in the
/ / configuration but not present in runtime , 0 is the default and thus 0 % of
/ / requests will be mirrored.
/ /
/ / . . attention : :
/ /
/ / * * This field is deprecated * * . Set the
/ / : ref : ` runtime_fraction
/ / < envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_fraction > ` field instead.
string runtime_key = 2 [ deprecated = true ] ;
/ / If both : ref : ` runtime_key
/ / < envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_key > ` and this field are not
/ / specified , all requests to the target cluster will be mirrored.
/ /
/ / If specified , this field takes precedence over the ` runtime_key ` field and requests must also
/ / fall under the percentage of matches indicated by this field.
/ /
/ / For some fraction N / D , a random number in the range [ 0 , D ) is selected. If the
/ / number is < = the value of the numerator N , or if the key is not present , the default
/ / value , the request will be mirrored.
/ /
/ / . . note : :
/ /
/ / Parsing this field is implemented such that the runtime key ' s data may be represented
/ / as a : ref : ` FractionalPercent < envoy_api_msg_type.FractionalPercent > ` proto represented
/ / as JSON / YAML and may also be represented as an integer with the assumption that the value
/ / is an integral percentage out of 100. For instance , a runtime key lookup returning the
/ / value "42" would parse as a ` FractionalPercent ` whose numerator is 42 and denominator is
/ / HUNDRED. This is behaviour is different to that of the deprecated ` runtime_key ` field ,
/ / where the implicit denominator is 10000.
core.RuntimeFractionalPercent runtime_fraction = 3 ;
}
/ / Indicates that the route has a request mirroring policy.
RequestMirrorPolicy request_mirror_policy = 10 ;
@ -682,10 +785,6 @@ message RouteAction {
/ / https : / / github.com / lyft / protoc - gen - validate / issues / 42 is resolved. ]
core.RoutingPriority priority = 11 ;
reserved 12 ;
reserved 18 ;
reserved 19 ;
/ / Specifies a set of rate limit configurations that could be applied to the
/ / route.
repeated RateLimit rate_limits = 13 ;
@ -696,85 +795,6 @@ message RouteAction {
/ / request.
google.protobuf.BoolValue include_vh_rate_limits = 14 ;
/ / Specifies the route ' s hashing policy if the upstream cluster uses a hashing : ref : ` load balancer
/ / < arch_overview_load_balancing_types > ` .
message HashPolicy {
message Header {
/ / The name of the request header that will be used to obtain the hash
/ / key. If the request header is not present , no hash will be produced.
string header_name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
}
/ / Envoy supports two types of cookie affinity :
/ /
/ / 1. Passive. Envoy takes a cookie that ' s present in the cookies header and
/ / hashes on its value.
/ /
/ / 2. Generated. Envoy generates and sets a cookie with an expiration ( TTL )
/ / on the first request from the client in its response to the client ,
/ / based on the endpoint the request gets sent to . The client then
/ / presents this on the next and all subsequent requests. The hash of
/ / this is sufficient to ensure these requests get sent to the same
/ / endpoint. The cookie is generated by hashing the source and
/ / destination ports and addresses so that multiple independent HTTP2
/ / streams on the same connection will independently receive the same
/ / cookie , even if they arrive at the Envoy simultaneously.
message Cookie {
/ / The name of the cookie that will be used to obtain the hash key. If the
/ / cookie is not present and ttl below is not set , no hash will be
/ / produced.
string name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
/ / If specified , a cookie with the TTL will be generated if the cookie is
/ / not present. If the TTL is present and zero , the generated cookie will
/ / be a session cookie.
google.protobuf.Duration ttl = 2 ;
/ / The name of the path for the cookie. If no path is specified here , no path
/ / will be set for the cookie.
string path = 3 ;
}
message ConnectionProperties {
/ / Hash on source IP address.
bool source_ip = 1 ;
}
oneof policy_specifier {
option ( validate.required ) = true ;
/ / Header hash policy.
Header header = 1 ;
/ / Cookie hash policy.
Cookie cookie = 2 ;
/ / Connection properties hash policy.
ConnectionProperties connection_properties = 3 ;
}
/ / The flag that shortcircuits the hash computing. This field provides a
/ / 'fallback' style of configuration : " if a terminal policy doesn ' t work ,
/ / fallback to rest of the policy list " , it saves time when the terminal
/ / policy works.
/ /
/ / If true , and there is already a hash computed , ignore rest of the
/ / list of hash polices.
/ / For example , if the following hash methods are configured :
/ /
/ / = = = = = = = = = = = = = = = = =
/ / specifier terminal
/ / = = = = = = = = = = = = = = = = =
/ / Header A true
/ / Header B false
/ / Header C false
/ / = = = = = = = = = = = = = = = = =
/ /
/ / The generateHash process ends if policy "header A" generates a hash , as
/ / it ' s a terminal policy.
bool terminal = 4 ;
}
/ / Specifies a list of hash policies to use for ring hash load balancing. Each
/ / hash policy is evaluated individually and the combined result is used to
/ / route the request. The method of combination is deterministic such that
@ -789,14 +809,9 @@ message RouteAction {
/ / ignoring the rest of the hash policy list.
repeated HashPolicy hash_policy = 15 ;
reserved 16 ;
reserved 22 ;
/ / Indicates that the route has a CORS policy.
CorsPolicy cors = 17 ;
reserved 21 ;
/ / If present , and the request is a gRPC request , use the
/ / ` grpc - timeout header < https : / / github.com / grpc / grpc / blob / master / doc / PROTOCOL - HTTP2.md > ` _ ,
/ / or its default value ( infinity ) instead of
@ -818,27 +833,8 @@ message RouteAction {
/ / infinity ) .
google.protobuf.Duration grpc_timeout_offset = 28 ;
/ / Allows enabling and disabling upgrades on a per - route basis.
/ / This overrides any enabled / disabled upgrade filter chain specified in the
/ / HttpConnectionManager
/ / : ref : upgrade_configs `
/ / < envoy_api_field_config.filter.network.http_connection_manager.v2.HttpConnectionManager.upgrade_configs > `
/ / but does not affect any custom filter chain specified there.
message UpgradeConfig {
/ / The case - insensitive name of this upgrade , e.g. "websocket" .
/ / For each upgrade type present in upgrade_configs , requests with
/ / Upgrade : [ upgrade_type ] will be proxied upstream.
string upgrade_type = 1 ;
/ / Determines if upgrades are available on this route. Defaults to true .
google.protobuf.BoolValue enabled = 2 ;
} ;
repeated UpgradeConfig upgrade_configs = 25 ;
/ / Configures : ref : ` internal redirect < arch_overview_internal_redirects > ` behavior.
enum InternalRedirectAction {
PASS_THROUGH_INTERNAL_REDIRECT = 0 ;
HANDLE_INTERNAL_REDIRECT = 1 ;
}
InternalRedirectAction internal_redirect_action = 26 ;
/ / Indicates that the route has a hedge policy. Note that if this is set ,
@ -850,6 +846,43 @@ message RouteAction {
/ / HTTP retry : ref : ` architecture overview < arch_overview_http_routing_retry > ` .
/ / [ # comment : next free field : 10 ]
message RetryPolicy {
message RetryPriority {
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
oneof config_type {
google.protobuf.Struct config = 2 ;
google.protobuf.Any typed_config = 3 ;
}
}
message RetryHostPredicate {
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
oneof config_type {
google.protobuf.Struct config = 2 ;
google.protobuf.Any typed_config = 3 ;
}
}
message RetryBackOff {
/ / Specifies the base interval between retries. This parameter is required and must be greater
/ / than zero. Values less than 1 ms are rounded up to 1 ms.
/ / See : ref : ` config_http_filters_router_x - envoy - max - retries ` for a discussion of Envoy ' s
/ / back - off algorithm.
google.protobuf.Duration base_interval = 1 [ ( validate.rules ) . duration = {
required : true
gt { }
} ] ;
/ / Specifies the maximum interval between retries. This parameter is optional , but must be
/ / greater than or equal to the ` base_interval ` if set. The default is 10 times the
/ / ` base_interval ` . See : ref : ` config_http_filters_router_x - envoy - max - retries ` for a discussion
/ / of Envoy ' s back - off algorithm.
google.protobuf.Duration max_interval = 2 [ ( validate.rules ) . duration = { gt { } } ] ;
}
/ / Specifies the conditions under which retry takes place. These are the same
/ / conditions documented for : ref : ` config_http_filters_router_x - envoy - retry - on ` and
/ / : ref : ` config_http_filters_router_x - envoy - retry - grpc - on ` .
@ -873,29 +906,11 @@ message RetryPolicy {
/ / would have been exhausted.
google.protobuf.Duration per_try_timeout = 3 ;
message RetryPriority {
string name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
oneof config_type {
google.protobuf.Struct config = 2 ;
google.protobuf.Any typed_config = 3 ;
}
}
/ / Specifies an implementation of a RetryPriority which is used to determine the
/ / distribution of load across priorities used for retries. Refer to
/ / : ref : ` retry plugin configuration < arch_overview_http_retry_plugins > ` for more details.
RetryPriority retry_priority = 4 ;
message RetryHostPredicate {
string name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
oneof config_type {
google.protobuf.Struct config = 2 ;
google.protobuf.Any typed_config = 3 ;
}
}
/ / Specifies a collection of RetryHostPredicates that will be consulted when selecting a host
/ / for retries. If any of the predicates reject the host , host selection will be reattempted.
/ / Refer to : ref : ` retry plugin configuration < arch_overview_http_retry_plugins > ` for more
@ -910,23 +925,6 @@ message RetryPolicy {
/ / HTTP status codes that should trigger a retry in addition to those specified by retry_on.
repeated uint32 retriable_status_codes = 7 ;
message RetryBackOff {
/ / Specifies the base interval between retries. This parameter is required and must be greater
/ / than zero. Values less than 1 ms are rounded up to 1 ms.
/ / See : ref : ` config_http_filters_router_x - envoy - max - retries ` for a discussion of Envoy ' s
/ / back - off algorithm.
google.protobuf.Duration base_interval = 1 [ ( validate.rules ) . duration = {
required : true ,
gt : { seconds : 0 }
} ] ;
/ / Specifies the maximum interval between retries. This parameter is optional , but must be
/ / greater than or equal to the ` base_interval ` if set. The default is 10 times the
/ / ` base_interval ` . See : ref : ` config_http_filters_router_x - envoy - max - retries ` for a discussion
/ / of Envoy ' s back - off algorithm.
google.protobuf.Duration max_interval = 2 [ ( validate.rules ) . duration.gt = { seconds : 0 } ] ;
}
/ / Specifies parameters that control retry back off. This parameter is optional , in which case the
/ / default base interval is 25 milliseconds or , if set , the current value of the
/ / ` upstream.base_retry_backoff_ms ` runtime parameter. The default maximum interval is 10 times
@ -946,13 +944,13 @@ message HedgePolicy {
/ / Must be at least 1.
/ / Defaults to 1.
/ / [ # not - implemented - hide : ]
google.protobuf.UInt32Value initial_requests = 1 [ ( validate.rules ) . uint32 . gte = 1 ] ;
google.protobuf.UInt32Value initial_requests = 1 [ ( validate.rules ) . uint32 = { gte : 1 } ] ;
/ / Specifies a probability that an additional upstream request should be sent
/ / on top of what is specified by initial_requests.
/ / Defaults to 0.
/ / [ # not - implemented - hide : ]
envoy. type.FractionalPercentadditional_request_chance = 2 ;
type.FractionalPercent additional_request_chance = 2 ;
/ / Indicates that a hedged request should be sent when the per - try timeout
/ / is hit. This will only occur if the retry policy also indicates that a
@ -966,6 +964,23 @@ message HedgePolicy {
}
message RedirectAction {
enum RedirectResponseCode {
/ / Moved Permanently HTTP Status Code - 301.
MOVED_PERMANENTLY = 0 ;
/ / Found HTTP Status Code - 302.
FOUND = 1 ;
/ / See Other HTTP Status Code - 303.
SEE_OTHER = 2 ;
/ / Temporary Redirect HTTP Status Code - 307.
TEMPORARY_REDIRECT = 3 ;
/ / Permanent Redirect HTTP Status Code - 308.
PERMANENT_REDIRECT = 4 ;
}
/ / When the scheme redirection take place , the following rules apply :
/ / 1. If the source URI scheme is ` http ` and the port is explicitly
/ / set to ` : 80 ` , the port will be removed after the redirection
@ -974,11 +989,14 @@ message RedirectAction {
oneof scheme_rewrite_specifier {
/ / The scheme portion of the URL will be swapped with "https" .
bool https_redirect = 4 ;
/ / The scheme portion of the URL will be swapped with this value.
string scheme_redirect = 7 ;
}
/ / The host portion of the URL will be swapped with this value.
string host_redirect = 1 ;
/ / The port value of the URL will be swapped with this value.
uint32 port_redirect = 8 ;
@ -997,26 +1015,9 @@ message RedirectAction {
string prefix_rewrite = 5 ;
}
enum RedirectResponseCode {
/ / Moved Permanently HTTP Status Code - 301.
MOVED_PERMANENTLY = 0 ;
/ / Found HTTP Status Code - 302.
FOUND = 1 ;
/ / See Other HTTP Status Code - 303.
SEE_OTHER = 2 ;
/ / Temporary Redirect HTTP Status Code - 307.
TEMPORARY_REDIRECT = 3 ;
/ / Permanent Redirect HTTP Status Code - 308.
PERMANENT_REDIRECT = 4 ;
}
/ / The HTTP status code to use in the redirect response. The default response
/ / code is MOVED_PERMANENTLY ( 301 ) .
RedirectResponseCode response_code = 3 [ ( validate.rules ) . enum.defined_only = true ] ;
RedirectResponseCode response_code = 3 [ ( validate.rules ) . enum = { defined_only : true } ] ;
/ / Indicates that during redirection , the query portion of the URL will
/ / be removed. Default value is false .
@ -1025,7 +1026,7 @@ message RedirectAction {
message DirectResponseAction {
/ / Specifies the HTTP response status to be returned.
uint32 status = 1 [ ( validate.rules ) . uint32 = { gte : 100 , lt : 6 00} ] ;
uint32 status = 1 [ ( validate.rules ) . uint32 = { lt : 600 gte : 1 00} ] ;
/ / Specifies the content of the response body. If this setting is omitted ,
/ / no body is included in the generated response.
@ -1047,25 +1048,24 @@ message Decorator {
/ / For ingress ( inbound ) requests , or egress ( outbound ) responses , this value may be overridden
/ / by the : ref : ` x - envoy - decorator - operation
/ / < config_http_filters_router_x - envoy - decorator - operation > ` header.
string operation = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string operation = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
}
message Tracing {
/ / Target percentage of requests managed by this HTTP connection manager that will be force
/ / traced if the : ref : ` x - client - trace - id < config_http_conn_man_headers_x - client - trace - id > `
/ / header is set. This field is a direct analog for the runtime variable
/ / 'tracing.client_sampling' in the : ref : ` HTTP Connection Manager
/ / < config_http_conn_man_runtime > ` .
/ / Default : 100 %
envoy. type.FractionalPercentclient_sampling = 1 ;
type.FractionalPercent client_sampling = 1 ;
/ / Target percentage of requests managed by this HTTP connection manager that will be randomly
/ / selected for trace generation , if not requested by the client or not forced. This field is
/ / a direct analog for the runtime variable 'tracing.random_sampling' in the
/ / : ref : ` HTTP Connection Manager < config_http_conn_man_runtime > ` .
/ / Default : 100 %
envoy. type.FractionalPercentrandom_sampling = 2 ;
type.FractionalPercent random_sampling = 2 ;
/ / Target percentage of requests managed by this HTTP connection manager that will be traced
/ / after all other sampling checks have been applied ( client - directed , force tracing , random
@ -1075,7 +1075,7 @@ message Tracing {
/ / analog for the runtime variable 'tracing.global_enabled' in the
/ / : ref : ` HTTP Connection Manager < config_http_conn_man_runtime > ` .
/ / Default : 100 %
envoy. type.FractionalPercentoverall_sampling = 3 ;
type.FractionalPercent overall_sampling = 3 ;
}
/ / A virtual cluster is a way of specifying a regex matching rule against
@ -1109,7 +1109,7 @@ message VirtualCluster {
/ / . . attention : :
/ / This field has been deprecated in favor of ` headers ` as it is not safe for use with
/ / untrusted input in all cases.
string pattern = 1 [ ( validate.rules ) . string . max_bytes = 1024 , deprecated = true ] ;
string pattern = 1 [ ( validate.rules ) . string = { max_bytes : 1024 } , deprecated = true ] ;
/ / Specifies a list of header matchers to use for matching requests. Each specified header must
/ / match. The pseudo - headers ` : path ` and ` : method ` can be used to match the request path and
@ -1119,7 +1119,7 @@ message VirtualCluster {
/ / Specifies the name of the virtual cluster. The virtual cluster name as well
/ / as the virtual host name are used when emitting statistics. The statistics are emitted by the
/ / router filter and are documented : ref : ` here < config_http_filters_router_stats > ` .
string name = 2 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string name = 2 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / Optionally specifies the HTTP method to match on. For example GET , PUT ,
/ / etc.
@ -1131,18 +1131,6 @@ message VirtualCluster {
/ / Global rate limiting : ref : ` architecture overview < arch_overview_rate_limit > ` .
message RateLimit {
/ / Refers to the stage set in the filter. The rate limit configuration only
/ / applies to filters with the same stage number. The default stage number is
/ / 0.
/ /
/ / . . note : :
/ /
/ / The filter supports a range of 0 - 10 inclusively for stage numbers.
google.protobuf.UInt32Value stage = 1 [ ( validate.rules ) . uint32 . lte = 10 ] ;
/ / The key to be set in runtime to disable this rate limit configuration.
string disable_key = 2 ;
message Action {
/ / The following descriptor entry is appended to the descriptor :
/ /
@ -1183,10 +1171,10 @@ message RateLimit {
/ / The header name to be queried from the request headers. The header ’ s
/ / value is used to populate the value of the descriptor entry for the
/ / descriptor_key.
string header_name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string header_name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / The key to use in the descriptor entry.
string descriptor_key = 2 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string descriptor_key = 2 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
}
/ / The following descriptor entry is appended to the descriptor and is populated using the
@ -1205,7 +1193,7 @@ message RateLimit {
/ / ( "generic_key" , "<descriptor_value>" )
message GenericKey {
/ / The value to use in the descriptor entry.
string descriptor_value = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string descriptor_value = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
}
/ / The following descriptor entry is appended to the descriptor :
@ -1215,7 +1203,7 @@ message RateLimit {
/ / ( "header_match" , "<descriptor_value>" )
message HeaderValueMatch {
/ / The value to use in the descriptor entry.
string descriptor_value = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string descriptor_value = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / If set to true , the action will append a descriptor entry when the
/ / request matches the headers. If set to false , the action will append a
@ -1228,7 +1216,7 @@ message RateLimit {
/ / specified headers in the config. A match will happen if all the
/ / headers in the config are present in the request with the same values
/ / ( or based on presence if the value field is not in the config ) .
repeated HeaderMatcher headers = 3 [ ( validate.rules ) . repeated . min_items = 1 ] ;
repeated HeaderMatcher headers = 3 [ ( validate.rules ) . repeated = { min_items : 1 } ] ;
}
oneof action_specifier {
@ -1254,13 +1242,25 @@ message RateLimit {
}
}
/ / Refers to the stage set in the filter. The rate limit configuration only
/ / applies to filters with the same stage number. The default stage number is
/ / 0.
/ /
/ / . . note : :
/ /
/ / The filter supports a range of 0 - 10 inclusively for stage numbers.
google.protobuf.UInt32Value stage = 1 [ ( validate.rules ) . uint32 = { lte : 10 } ] ;
/ / The key to be set in runtime to disable this rate limit configuration.
string disable_key = 2 ;
/ / A list of actions that are to be applied for this rate limit configuration.
/ / Order matters as the actions are processed sequentially and the descriptor
/ / is composed by appending descriptor entries in that sequence. If an action
/ / cannot append a descriptor entry , no descriptor is generated for the
/ / configuration. See : ref : ` composing actions
/ / < config_http_filters_rate_limit_composing_actions > ` for additional documentation.
repeated Action actions = 3 [ ( validate.rules ) . repeated . min_items = 1 ] ;
repeated Action actions = 3 [ ( validate.rules ) . repeated = { min_items : 1 } ] ;
}
/ / . . attention : :
@ -1288,11 +1288,10 @@ message RateLimit {
/ /
/ / [ # next - major - version : HeaderMatcher should be refactored to use StringMatcher. ]
message HeaderMatcher {
/ / Specifies the name of the header in the request.
string name = 1 [ ( validate.rules ) . string . min_bytes = 1 ] ;
reserved 2 , 3 ;
reserved 2 ;
reserved 3 ;
/ / Specifies the name of the header in the request.
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / Specifies how the header match will be performed to route the request.
oneof header_match_specifier {
@ -1313,7 +1312,7 @@ message HeaderMatcher {
/ / . . attention : :
/ / This field has been deprecated in favor of ` safe_regex_match ` as it is not safe for use
/ / with untrusted input in all cases.
string regex_match = 5 [ ( validate.rules ) . string . max_bytes = 1024 , deprecated = true ] ;
string regex_match = 5 [ ( validate.rules ) . string = { max_bytes : 1024 } , deprecated = true ] ;
/ / If specified , this regex string is a regular expression rule which implies the entire request
/ / header value must match the regex. The rule will not match if only a subsequence of the
@ -1331,7 +1330,7 @@ message HeaderMatcher {
/ /
/ / * For range [ - 10 , 0 ) , route will match for header value - 1 , but not for 0 , "somestring" , 10.9 ,
/ / "-1somestring"
envoy. type.Int64Rangerange_match = 6 ;
type.Int64Range range_match = 6 ;
/ / If specified , header match will be performed based on whether the header is in the
/ / request.
@ -1343,7 +1342,7 @@ message HeaderMatcher {
/ / Examples :
/ /
/ / * The prefix * abcd * matches the value * abcdxyz * , but not for * abcxyz * .
string prefix_match = 9 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string prefix_match = 9 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
/ / If specified , header match will be performed based on the suffix of the header value.
/ / Note : empty suffix is not allowed , please use present_match instead.
@ -1351,7 +1350,7 @@ message HeaderMatcher {
/ / Examples :
/ /
/ / * The suffix * abcd * matches the value * xyzabcd * , but not for * xyzbcd * .
string suffix_match = 10 [ ( validate.rules ) . string . min_bytes = 1 ] ;
string suffix_match = 10 [ ( validate.rules ) . string = { min_bytes : 1 } ] ;
}
/ / If specified , the match result will be inverted before checking. Defaults to false .
@ -1368,7 +1367,7 @@ message HeaderMatcher {
message QueryParameterMatcher {
/ / Specifies the name of a key that must be present in the requested
/ / * path * ' s query string .
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 , max_bytes : 1024 } ] ;
string name = 1 [ ( validate.rules ) . string = { min_bytes : 1 max_bytes : 1024 } ] ;
/ / Specifies the value of the key. If the value is absent , a request
/ / that contains the key in its query string will match , whether the
@ -1389,7 +1388,7 @@ message QueryParameterMatcher {
oneof query_parameter_match_specifier {
/ / Specifies whether a query parameter value should match against a string .
type.matcher.StringMatcher string_match = 5 [ ( validate.rules ) . message.required = true ] ;
type.matcher.StringMatcher string_match = 5 [ ( validate.rules ) . message = { required : true } ] ;
/ / Specifies whether a query parameter should be present.
bool present_match = 6 ;
data-plane-api(CircleCI)
5 years ago