# DO NOT EDIT - Generated by Cue OpenAPI generator based on Istio APIs.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: clusters.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: Cluster
    listKind: ClusterList
    plural: clusters
    shortNames:
    - tcs
    singular: cluster
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.state.xcpVersion
      name: Version
      type: string
    - jsonPath: .spec.state.provider
      name: Provider
      type: string
    - jsonPath: .spec.tier1Cluster
      name: Tier1
      type: string
    - jsonPath: .spec.locality.region
      name: Region
      type: string
    - jsonPath: .spec.network
      name: Network
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: A Kubernetes cluster managing both pods and VMs.
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              labels:
                additionalProperties:
                  type: string
                type: object
              locality:
                description: Location information about the cluster which can be used
                  for routing.
                properties:
                  region:
                    description: The geographic location of the cluster.
                    type: string
                type: object
              namespaceScope:
                description: Configure the default scoping of namespaces in this cluster.
                properties:
                  exceptions:
                    description: Namespaces to be excluded form the default scope.
                    items:
                      type: string
                    type: array
                  scope:
                    enum:
                    - GLOBAL
                    - LOCAL
                    type: string
                type: object
              namespaces:
                items:
                  properties:
                    name:
                      type: string
                    services:
                      items:
                        properties:
                          canonicalName:
                            type: string
                          gatewayHost:
                            type: boolean
                          hostname:
                            description: The hostname by which this service is accessed.
                            type: string
                          kubernetesExternalAddresses:
                            items:
                              type: string
                            type: array
                          kubernetesServiceFqdn:
                            type: string
                          kubernetesServiceIp:
                            type: string
                          meshExternal:
                            type: boolean
                          name:
                            type: string
                          namespace:
                            description: namespace associated with the service.
                            type: string
                          numHops:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          numKubernetesEndpoints:
                            description: The number of kubernetes pods providing this
                              service.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          numVmEndpoints:
                            description: The number of VMs providing this service.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          ports:
                            description: The set of ports on which this service is
                              exposed.
                            items:
                              properties:
                                kubernetesNodePort:
                                  maximum: 4294967295
                                  minimum: 0
                                  type: integer
                                name:
                                  description: Name assigned to the port.
                                  type: string
                                number:
                                  description: A valid non-negative integer port number.
                                  maximum: 4294967295
                                  minimum: 0
                                  type: integer
                              type: object
                            type: array
                          selector:
                            additionalProperties:
                              type: string
                            description: label selectors associated with the service.
                            type: object
                          spiffeIds:
                            description: List of SPIFFE identities used by the workloads
                              of the service.
                            items:
                              type: string
                            type: array
                          subsets:
                            items:
                              type: string
                            type: array
                          tier1GatewayHost:
                            type: boolean
                          workloads:
                            description: Workloads implementing the Service.
                            items:
                              properties:
                                address:
                                  description: Routable address of the workload.
                                  type: string
                                isVm:
                                  description: Indicates whether the workload is kubernetes
                                    endpoint or vm.
                                  type: boolean
                                name:
                                  description: Instance name of the workload.
                                  type: string
                                proxy:
                                  description: Proxy details.
                                  properties:
                                    controlPlaneAddress:
                                      type: string
                                    envoyVersion:
                                      description: Envoy version of the proxy.
                                      type: string
                                    istioVersion:
                                      description: Istio version of the proxy.
                                      type: string
                                    status:
                                      additionalProperties:
                                        type: string
                                      description: Sync status for each xDS component.
                                      type: object
                                  type: object
                              type: object
                            type: array
                        type: object
                      type: array
                  type: object
                type: array
              network:
                description: The network (e.g., VPC) where this cluster is present.
                type: string
              state:
                properties:
                  istioVersions:
                    description: This shows currently running istio versions in the
                      cluster.
                    items:
                      type: string
                    type: array
                  lastSyncTime:
                    format: date-time
                    type: string
                  provider:
                    description: cluster provider.
                    type: string
                  xcpVersion:
                    type: string
                type: object
              tier1Cluster:
                description: Indicates whether this cluster is hosting a tier1 gateway
                  or not.
                nullable: true
                type: boolean
              tokenTtl:
                description: Lifetime of the tokens.
                type: string
              trustDomain:
                description: Trust domain for this cluster, used for multi-cluster
                  routing.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: organizations.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: Organization
    listKind: OrganizationList
    plural: organizations
    shortNames:
    - to
    singular: organization
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`Organization` is the root of the Service Bridge object
              hierarchy.'
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: organizationsettings.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: OrganizationSetting
    listKind: OrganizationSettingList
    plural: organizationsettings
    shortNames:
    - tos
    singular: organizationsetting
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: Settings that apply globally to the entire organization.
            properties:
              defaultSecuritySetting:
                description: Security settings for all proxy workloads in this organization.
                properties:
                  authentication:
                    enum:
                    - UNSET
                    - OPTIONAL
                    - REQUIRED
                    type: string
                  authenticationSettings:
                    properties:
                      http:
                        oneOf:
                        - not:
                            anyOf:
                            - properties:
                                jwt:
                                  oneOf:
                                  - not:
                                      anyOf:
                                      - required:
                                        - jwksUri
                                      - required:
                                        - jwks
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              required:
                              - jwt
                        - properties:
                            jwt:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              - required:
                                - jwksUri
                              - required:
                                - jwks
                          required:
                          - jwt
                        properties:
                          jwt:
                            properties:
                              audiences:
                                items:
                                  type: string
                                type: array
                              issuer:
                                description: Identifies the issuer that issued the
                                  JWT.
                                type: string
                              jwks:
                                description: JSON Web Key Set of public keys to validate
                                  signature of the JWT.
                                type: string
                              jwksUri:
                                type: string
                            type: object
                        type: object
                      trafficMode:
                        enum:
                        - UNSET
                        - OPTIONAL
                        - REQUIRED
                        type: string
                    type: object
                  authorization:
                    properties:
                      http:
                        description: This is for configuring HTTP request authorization.
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - external
                            - required:
                              - local
                        - required:
                          - external
                        - required:
                          - local
                        properties:
                          external:
                            properties:
                              includeRequestHeaders:
                                items:
                                  type: string
                                type: array
                              tls:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - files
                                - required:
                                  - files
                                properties:
                                  files:
                                    properties:
                                      caCertificates:
                                        type: string
                                      clientCertificate:
                                        description: Certificate file to authenticate
                                          the client.
                                        type: string
                                      privateKey:
                                        description: Private key file associated with
                                          the client certificate.
                                        type: string
                                    type: object
                                  mode:
                                    enum:
                                    - DISABLED
                                    - SIMPLE
                                    - MUTUAL
                                    type: string
                                  subjectAltNames:
                                    items:
                                      type: string
                                    type: array
                                type: object
                              uri:
                                type: string
                            type: object
                          local:
                            properties:
                              rules:
                                items:
                                  properties:
                                    from:
                                      items:
                                        properties:
                                          jwt:
                                            description: JWT configuration to identity
                                              the subject.
                                            properties:
                                              iss:
                                                type: string
                                              other:
                                                additionalProperties:
                                                  type: string
                                                description: A set of arbitrary claims
                                                  that are required to qualify the
                                                  subject.
                                                type: object
                                              sub:
                                                type: string
                                            type: object
                                        type: object
                                      type: array
                                    name:
                                      description: A friendly name to identify the
                                        binding.
                                      type: string
                                    to:
                                      items:
                                        properties:
                                          methods:
                                            description: The HTTP methods that are
                                              allowed by this rule.
                                            items:
                                              type: string
                                            type: array
                                          paths:
                                            description: The request path where the
                                              request is made against.
                                            items:
                                              type: string
                                            type: array
                                        type: object
                                      type: array
                                  type: object
                                type: array
                            type: object
                        type: object
                      mode:
                        description: A short cut for specifying the set of allowed
                          callers.
                        enum:
                        - UNSET
                        - NAMESPACE
                        - GROUP
                        - WORKSPACE
                        - CLUSTER
                        - DISABLED
                        - CUSTOM
                        - RULES
                        type: string
                      rules:
                        properties:
                          allow:
                            description: Allow specifies a list of rules.
                            items:
                              properties:
                                from:
                                  description: From specifies the source of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the source of a request.
                                      type: string
                                  type: object
                                to:
                                  description: To specifies the destination of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the destination of a
                                        request.
                                      type: string
                                  type: object
                              type: object
                            type: array
                          deny:
                            description: Deny specifies a list of rules.
                            items:
                              properties:
                                from:
                                  description: From specifies the source of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the source of a request.
                                      type: string
                                  type: object
                                to:
                                  description: To specifies the destination of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the destination of a
                                        request.
                                      type: string
                                  type: object
                              type: object
                            type: array
                          denyAll:
                            description: Deny all specifies whether all requests should
                              be rejected.
                            type: boolean
                        type: object
                      serviceAccounts:
                        items:
                          type: string
                        type: array
                    type: object
                  description:
                    description: A description of the resource.
                    type: string
                  displayName:
                    description: User friendly name for the resource.
                    type: string
                  etag:
                    description: The etag for the resource.
                    type: string
                  fqn:
                    description: Fully-qualified name of the resource.
                    type: string
                  propagationStrategy:
                    enum:
                    - REPLACE
                    - STRICTER
                    type: string
                  wafSettings:
                    description: 'NOTICE: this feature is in alpha stage and under
                      active development.'
                    properties:
                      ruleEngineMode:
                        description: Ad-hoc settings to switch ModSecurity engine
                          mode.
                        enum:
                        - "OFF"
                        - "ON"
                        - DETECTION_ONLY
                        type: string
                      ruleSets:
                        description: Rulesets to enable.
                        items:
                          type: string
                        type: array
                    type: object
                type: object
              defaultTrafficSetting:
                description: Traffic settings for all proxy workloads in this organization.
                properties:
                  description:
                    description: A description of the resource.
                    type: string
                  displayName:
                    description: User friendly name for the resource.
                    type: string
                  egress:
                    properties:
                      host:
                        description: Specifies the egress gateway hostname.
                        type: string
                      port:
                        description: Deprecated.
                        format: int32
                        type: integer
                    type: object
                  etag:
                    description: The etag for the resource.
                    type: string
                  fqn:
                    description: Fully-qualified name of the resource.
                    type: string
                  rateLimiting:
                    description: Configuration for rate limiting requests.
                    oneOf:
                    - not:
                        anyOf:
                        - required:
                          - settings
                        - required:
                          - externalService
                    - required:
                      - settings
                    - required:
                      - externalService
                    properties:
                      externalService:
                        description: Configure ratelimiting using an external ratelimit
                          server.
                        properties:
                          domain:
                            description: The rate limit domain to use when calling
                              the rate limit service.
                            type: string
                          failClosed:
                            type: boolean
                          rateLimitServerUri:
                            description: The URI at which the external rate limit
                              server can be reached.
                            type: string
                          rules:
                            description: A set of rate limit rules.
                            items:
                              properties:
                                dimensions:
                                  description: A list of dimensions that are to be
                                    applied for this rate limit configuration.
                                  items:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - sourceCluster
                                        - required:
                                          - destinationCluster
                                        - required:
                                          - remoteAddress
                                        - required:
                                          - requestHeaders
                                        - required:
                                          - headerValueMatch
                                    - required:
                                      - sourceCluster
                                    - required:
                                      - destinationCluster
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - requestHeaders
                                    - required:
                                      - headerValueMatch
                                    properties:
                                      destinationCluster:
                                        description: Rate limit on destination envoy
                                          cluster.
                                        type: object
                                      headerValueMatch:
                                        description: Rate limit on the existence of
                                          certain request headers.
                                        properties:
                                          descriptorValue:
                                            description: The value to use in the descriptor
                                              entry.
                                            type: string
                                          headers:
                                            additionalProperties:
                                              oneOf:
                                              - not:
                                                  anyOf:
                                                  - required:
                                                    - exact
                                                  - required:
                                                    - prefix
                                                  - required:
                                                    - regex
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                              properties:
                                                exact:
                                                  description: Exact string match.
                                                  type: string
                                                prefix:
                                                  description: Prefix-based match.
                                                  type: string
                                                regex:
                                                  description: ECMAscript style regex-based
                                                    match.
                                                  type: string
                                              type: object
                                            type: object
                                        type: object
                                      remoteAddress:
                                        description: Rate limit on remote address
                                          of client.
                                        type: object
                                      requestHeaders:
                                        description: Rate limit on the value of certain
                                          request headers.
                                        properties:
                                          descriptorKey:
                                            description: The key to use in the descriptor
                                              entry.
                                            type: string
                                          headerName:
                                            description: The header name to be queried
                                              from the request headers.
                                            type: string
                                        type: object
                                      sourceCluster:
                                        description: Rate limit on source envoy cluster.
                                        type: object
                                    type: object
                                  type: array
                              type: object
                            type: array
                          timeout:
                            description: The timeout in seconds for the external rate
                              limit server RPC.
                            type: string
                          tls:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - files
                            - required:
                              - files
                            properties:
                              files:
                                properties:
                                  caCertificates:
                                    type: string
                                  clientCertificate:
                                    description: Certificate file to authenticate
                                      the client.
                                    type: string
                                  privateKey:
                                    description: Private key file associated with
                                      the client certificate.
                                    type: string
                                type: object
                              mode:
                                enum:
                                - DISABLED
                                - SIMPLE
                                - MUTUAL
                                type: string
                              subjectAltNames:
                                items:
                                  type: string
                                type: array
                            type: object
                        type: object
                      settings:
                        properties:
                          failClosed:
                            type: boolean
                          rules:
                            description: A list of rules for ratelimiting.
                            items:
                              properties:
                                dimensions:
                                  description: A list of dimensions to define each
                                    ratelimit rule.
                                  items:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - remoteAddress
                                        - required:
                                          - header
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - header
                                    properties:
                                      header:
                                        description: Rate limit on certain HTTP headers.
                                        properties:
                                          name:
                                            description: Name of the header to match
                                              on.
                                            type: string
                                          value:
                                            description: Value of the header to match
                                              on if matching on a specific value.
                                            oneOf:
                                            - not:
                                                anyOf:
                                                - required:
                                                  - exact
                                                - required:
                                                  - prefix
                                                - required:
                                                  - regex
                                            - required:
                                              - exact
                                            - required:
                                              - prefix
                                            - required:
                                              - regex
                                            properties:
                                              exact:
                                                description: Exact string match.
                                                type: string
                                              prefix:
                                                description: Prefix-based match.
                                                type: string
                                              regex:
                                                description: ECMAscript style regex-based
                                                  match.
                                                type: string
                                            type: object
                                        type: object
                                      remoteAddress:
                                        description: Rate limit on the remote address
                                          of client.
                                        properties:
                                          value:
                                            description: Ratelimit on a specific remote
                                              address.
                                            type: string
                                        type: object
                                    type: object
                                  type: array
                                limit:
                                  description: The ratelimit value that will be configured
                                    for the above rules.
                                  properties:
                                    requestsPerUnit:
                                      description: Specifies the value of the rate
                                        limit.
                                      maximum: 4294967295
                                      minimum: 0
                                      type: integer
                                    unit:
                                      description: Specifies the unit of time for
                                        rate limit.
                                      enum:
                                      - UNKNOWN
                                      - SECOND
                                      - MINUTE
                                      - HOUR
                                      - DAY
                                      type: string
                                  type: object
                              type: object
                            type: array
                          timeout:
                            description: The timeout in seconds for the rate limit
                              server RPC.
                            type: string
                        type: object
                    type: object
                  reachability:
                    properties:
                      hosts:
                        items:
                          type: string
                        type: array
                      mode:
                        description: A short cut for specifying the set of services
                          accessed by the workload.
                        enum:
                        - UNSET
                        - NAMESPACE
                        - GROUP
                        - WORKSPACE
                        - CLUSTER
                        - CUSTOM
                        type: string
                    type: object
                  resilience:
                    properties:
                      circuitBreakerSensitivity:
                        enum:
                        - UNSET
                        - LOW
                        - MEDIUM
                        - HIGH
                        type: string
                      httpRequestTimeout:
                        description: Timeout for HTTP requests.
                        type: string
                      httpRetries:
                        description: Retry policy for HTTP requests.
                        properties:
                          attempts:
                            description: Number of retries for a given request.
                            format: int32
                            type: integer
                          perTryTimeout:
                            description: Timeout per retry attempt for a given request.
                            type: string
                          retryOn:
                            description: Specifies the conditions under which retry
                              takes place.
                            type: string
                        type: object
                      keepAlive:
                        description: Keep Alive Settings.
                        properties:
                          tcp:
                            description: TCP Keep Alive settings associated with the
                              upstream and downstream TCP connections.
                            properties:
                              downstream:
                                description: TCP Keep Alive Settings associated with
                                  the downstream (client) connection.
                                properties:
                                  idleTime:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  interval:
                                    description: The number of seconds between keep-alive
                                      probes.
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  probes:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                type: object
                              upstream:
                                description: TCP Keep Alive Settings associated with
                                  the upstream (backend) connection.
                                properties:
                                  idleTime:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  interval:
                                    description: The number of seconds between keep-alive
                                      probes.
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  probes:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                type: object
                            type: object
                        type: object
                      tcpKeepalive:
                        description: Deprecated.
                        nullable: true
                        type: boolean
                    type: object
                type: object
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              networkSettings:
                description: Reachability between clusters on various networks.
                properties:
                  networkReachability:
                    additionalProperties:
                      type: string
                    description: Reachability between clusters on various networks.
                    type: object
                type: object
              regionalFailover:
                description: Default locality routing settings for all gateways.
                items:
                  properties:
                    from:
                      description: Originating region.
                      type: string
                    to:
                      type: string
                  type: object
                type: array
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: serviceaccounts.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: ServiceAccount
    listKind: ServiceAccountList
    plural: serviceaccounts
    shortNames:
    - tsa
    singular: serviceaccount
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`ServiceAccount` represents a service account that can be
              used to access the TSB platform.'
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              keys:
                description: Keys associated with the service account.
                items:
                  properties:
                    defaultToken:
                      type: string
                    encoding:
                      description: Format in which the public and private keys are
                        encoded.
                      enum:
                      - PEM
                      - JWK
                      type: string
                    id:
                      description: Unique identifier for this key-pair.
                      type: string
                    privateKey:
                      description: The encoded private key associated with the service
                        account.
                      type: string
                    publicKey:
                      description: The encoded public key associated with the service
                        account.
                      type: string
                  type: object
                type: array
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: teams.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: Team
    listKind: TeamList
    plural: teams
    shortNames:
    - ttm
    singular: team
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.sourceType
      name: Source
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`Team` is a named collection of users under a tenant.'
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              members:
                description: List of members under the team.
                items:
                  type: string
                type: array
              sourceType:
                description: Where the team comes from.
                enum:
                - INVALID
                - LDAP
                - LOCAL
                - AZURE
                - MANUAL
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: tenants.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: Tenant
    listKind: TenantList
    plural: tenants
    shortNames:
    - tt
    singular: tenant
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`Tenant` is a self-contained entity within an organization
              in the Service Bridge hierarchy.'
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: tenantsettings.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: TenantSetting
    listKind: TenantSettingList
    plural: tenantsettings
    shortNames:
    - tts
    singular: tenantsetting
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: Default settings that apply to all workspaces under a tenant.
            properties:
              defaultSecuritySetting:
                description: Security settings for all proxy workloads in this tenant.
                properties:
                  authentication:
                    enum:
                    - UNSET
                    - OPTIONAL
                    - REQUIRED
                    type: string
                  authenticationSettings:
                    properties:
                      http:
                        oneOf:
                        - not:
                            anyOf:
                            - properties:
                                jwt:
                                  oneOf:
                                  - not:
                                      anyOf:
                                      - required:
                                        - jwksUri
                                      - required:
                                        - jwks
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              required:
                              - jwt
                        - properties:
                            jwt:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              - required:
                                - jwksUri
                              - required:
                                - jwks
                          required:
                          - jwt
                        properties:
                          jwt:
                            properties:
                              audiences:
                                items:
                                  type: string
                                type: array
                              issuer:
                                description: Identifies the issuer that issued the
                                  JWT.
                                type: string
                              jwks:
                                description: JSON Web Key Set of public keys to validate
                                  signature of the JWT.
                                type: string
                              jwksUri:
                                type: string
                            type: object
                        type: object
                      trafficMode:
                        enum:
                        - UNSET
                        - OPTIONAL
                        - REQUIRED
                        type: string
                    type: object
                  authorization:
                    properties:
                      http:
                        description: This is for configuring HTTP request authorization.
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - external
                            - required:
                              - local
                        - required:
                          - external
                        - required:
                          - local
                        properties:
                          external:
                            properties:
                              includeRequestHeaders:
                                items:
                                  type: string
                                type: array
                              tls:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - files
                                - required:
                                  - files
                                properties:
                                  files:
                                    properties:
                                      caCertificates:
                                        type: string
                                      clientCertificate:
                                        description: Certificate file to authenticate
                                          the client.
                                        type: string
                                      privateKey:
                                        description: Private key file associated with
                                          the client certificate.
                                        type: string
                                    type: object
                                  mode:
                                    enum:
                                    - DISABLED
                                    - SIMPLE
                                    - MUTUAL
                                    type: string
                                  subjectAltNames:
                                    items:
                                      type: string
                                    type: array
                                type: object
                              uri:
                                type: string
                            type: object
                          local:
                            properties:
                              rules:
                                items:
                                  properties:
                                    from:
                                      items:
                                        properties:
                                          jwt:
                                            description: JWT configuration to identity
                                              the subject.
                                            properties:
                                              iss:
                                                type: string
                                              other:
                                                additionalProperties:
                                                  type: string
                                                description: A set of arbitrary claims
                                                  that are required to qualify the
                                                  subject.
                                                type: object
                                              sub:
                                                type: string
                                            type: object
                                        type: object
                                      type: array
                                    name:
                                      description: A friendly name to identify the
                                        binding.
                                      type: string
                                    to:
                                      items:
                                        properties:
                                          methods:
                                            description: The HTTP methods that are
                                              allowed by this rule.
                                            items:
                                              type: string
                                            type: array
                                          paths:
                                            description: The request path where the
                                              request is made against.
                                            items:
                                              type: string
                                            type: array
                                        type: object
                                      type: array
                                  type: object
                                type: array
                            type: object
                        type: object
                      mode:
                        description: A short cut for specifying the set of allowed
                          callers.
                        enum:
                        - UNSET
                        - NAMESPACE
                        - GROUP
                        - WORKSPACE
                        - CLUSTER
                        - DISABLED
                        - CUSTOM
                        - RULES
                        type: string
                      rules:
                        properties:
                          allow:
                            description: Allow specifies a list of rules.
                            items:
                              properties:
                                from:
                                  description: From specifies the source of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the source of a request.
                                      type: string
                                  type: object
                                to:
                                  description: To specifies the destination of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the destination of a
                                        request.
                                      type: string
                                  type: object
                              type: object
                            type: array
                          deny:
                            description: Deny specifies a list of rules.
                            items:
                              properties:
                                from:
                                  description: From specifies the source of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the source of a request.
                                      type: string
                                  type: object
                                to:
                                  description: To specifies the destination of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the destination of a
                                        request.
                                      type: string
                                  type: object
                              type: object
                            type: array
                          denyAll:
                            description: Deny all specifies whether all requests should
                              be rejected.
                            type: boolean
                        type: object
                      serviceAccounts:
                        items:
                          type: string
                        type: array
                    type: object
                  description:
                    description: A description of the resource.
                    type: string
                  displayName:
                    description: User friendly name for the resource.
                    type: string
                  etag:
                    description: The etag for the resource.
                    type: string
                  fqn:
                    description: Fully-qualified name of the resource.
                    type: string
                  propagationStrategy:
                    enum:
                    - REPLACE
                    - STRICTER
                    type: string
                  wafSettings:
                    description: 'NOTICE: this feature is in alpha stage and under
                      active development.'
                    properties:
                      ruleEngineMode:
                        description: Ad-hoc settings to switch ModSecurity engine
                          mode.
                        enum:
                        - "OFF"
                        - "ON"
                        - DETECTION_ONLY
                        type: string
                      ruleSets:
                        description: Rulesets to enable.
                        items:
                          type: string
                        type: array
                    type: object
                type: object
              defaultTrafficSetting:
                description: Traffic settings for all proxy workloads in this tenant.
                properties:
                  description:
                    description: A description of the resource.
                    type: string
                  displayName:
                    description: User friendly name for the resource.
                    type: string
                  egress:
                    properties:
                      host:
                        description: Specifies the egress gateway hostname.
                        type: string
                      port:
                        description: Deprecated.
                        format: int32
                        type: integer
                    type: object
                  etag:
                    description: The etag for the resource.
                    type: string
                  fqn:
                    description: Fully-qualified name of the resource.
                    type: string
                  rateLimiting:
                    description: Configuration for rate limiting requests.
                    oneOf:
                    - not:
                        anyOf:
                        - required:
                          - settings
                        - required:
                          - externalService
                    - required:
                      - settings
                    - required:
                      - externalService
                    properties:
                      externalService:
                        description: Configure ratelimiting using an external ratelimit
                          server.
                        properties:
                          domain:
                            description: The rate limit domain to use when calling
                              the rate limit service.
                            type: string
                          failClosed:
                            type: boolean
                          rateLimitServerUri:
                            description: The URI at which the external rate limit
                              server can be reached.
                            type: string
                          rules:
                            description: A set of rate limit rules.
                            items:
                              properties:
                                dimensions:
                                  description: A list of dimensions that are to be
                                    applied for this rate limit configuration.
                                  items:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - sourceCluster
                                        - required:
                                          - destinationCluster
                                        - required:
                                          - remoteAddress
                                        - required:
                                          - requestHeaders
                                        - required:
                                          - headerValueMatch
                                    - required:
                                      - sourceCluster
                                    - required:
                                      - destinationCluster
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - requestHeaders
                                    - required:
                                      - headerValueMatch
                                    properties:
                                      destinationCluster:
                                        description: Rate limit on destination envoy
                                          cluster.
                                        type: object
                                      headerValueMatch:
                                        description: Rate limit on the existence of
                                          certain request headers.
                                        properties:
                                          descriptorValue:
                                            description: The value to use in the descriptor
                                              entry.
                                            type: string
                                          headers:
                                            additionalProperties:
                                              oneOf:
                                              - not:
                                                  anyOf:
                                                  - required:
                                                    - exact
                                                  - required:
                                                    - prefix
                                                  - required:
                                                    - regex
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                              properties:
                                                exact:
                                                  description: Exact string match.
                                                  type: string
                                                prefix:
                                                  description: Prefix-based match.
                                                  type: string
                                                regex:
                                                  description: ECMAscript style regex-based
                                                    match.
                                                  type: string
                                              type: object
                                            type: object
                                        type: object
                                      remoteAddress:
                                        description: Rate limit on remote address
                                          of client.
                                        type: object
                                      requestHeaders:
                                        description: Rate limit on the value of certain
                                          request headers.
                                        properties:
                                          descriptorKey:
                                            description: The key to use in the descriptor
                                              entry.
                                            type: string
                                          headerName:
                                            description: The header name to be queried
                                              from the request headers.
                                            type: string
                                        type: object
                                      sourceCluster:
                                        description: Rate limit on source envoy cluster.
                                        type: object
                                    type: object
                                  type: array
                              type: object
                            type: array
                          timeout:
                            description: The timeout in seconds for the external rate
                              limit server RPC.
                            type: string
                          tls:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - files
                            - required:
                              - files
                            properties:
                              files:
                                properties:
                                  caCertificates:
                                    type: string
                                  clientCertificate:
                                    description: Certificate file to authenticate
                                      the client.
                                    type: string
                                  privateKey:
                                    description: Private key file associated with
                                      the client certificate.
                                    type: string
                                type: object
                              mode:
                                enum:
                                - DISABLED
                                - SIMPLE
                                - MUTUAL
                                type: string
                              subjectAltNames:
                                items:
                                  type: string
                                type: array
                            type: object
                        type: object
                      settings:
                        properties:
                          failClosed:
                            type: boolean
                          rules:
                            description: A list of rules for ratelimiting.
                            items:
                              properties:
                                dimensions:
                                  description: A list of dimensions to define each
                                    ratelimit rule.
                                  items:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - remoteAddress
                                        - required:
                                          - header
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - header
                                    properties:
                                      header:
                                        description: Rate limit on certain HTTP headers.
                                        properties:
                                          name:
                                            description: Name of the header to match
                                              on.
                                            type: string
                                          value:
                                            description: Value of the header to match
                                              on if matching on a specific value.
                                            oneOf:
                                            - not:
                                                anyOf:
                                                - required:
                                                  - exact
                                                - required:
                                                  - prefix
                                                - required:
                                                  - regex
                                            - required:
                                              - exact
                                            - required:
                                              - prefix
                                            - required:
                                              - regex
                                            properties:
                                              exact:
                                                description: Exact string match.
                                                type: string
                                              prefix:
                                                description: Prefix-based match.
                                                type: string
                                              regex:
                                                description: ECMAscript style regex-based
                                                  match.
                                                type: string
                                            type: object
                                        type: object
                                      remoteAddress:
                                        description: Rate limit on the remote address
                                          of client.
                                        properties:
                                          value:
                                            description: Ratelimit on a specific remote
                                              address.
                                            type: string
                                        type: object
                                    type: object
                                  type: array
                                limit:
                                  description: The ratelimit value that will be configured
                                    for the above rules.
                                  properties:
                                    requestsPerUnit:
                                      description: Specifies the value of the rate
                                        limit.
                                      maximum: 4294967295
                                      minimum: 0
                                      type: integer
                                    unit:
                                      description: Specifies the unit of time for
                                        rate limit.
                                      enum:
                                      - UNKNOWN
                                      - SECOND
                                      - MINUTE
                                      - HOUR
                                      - DAY
                                      type: string
                                  type: object
                              type: object
                            type: array
                          timeout:
                            description: The timeout in seconds for the rate limit
                              server RPC.
                            type: string
                        type: object
                    type: object
                  reachability:
                    properties:
                      hosts:
                        items:
                          type: string
                        type: array
                      mode:
                        description: A short cut for specifying the set of services
                          accessed by the workload.
                        enum:
                        - UNSET
                        - NAMESPACE
                        - GROUP
                        - WORKSPACE
                        - CLUSTER
                        - CUSTOM
                        type: string
                    type: object
                  resilience:
                    properties:
                      circuitBreakerSensitivity:
                        enum:
                        - UNSET
                        - LOW
                        - MEDIUM
                        - HIGH
                        type: string
                      httpRequestTimeout:
                        description: Timeout for HTTP requests.
                        type: string
                      httpRetries:
                        description: Retry policy for HTTP requests.
                        properties:
                          attempts:
                            description: Number of retries for a given request.
                            format: int32
                            type: integer
                          perTryTimeout:
                            description: Timeout per retry attempt for a given request.
                            type: string
                          retryOn:
                            description: Specifies the conditions under which retry
                              takes place.
                            type: string
                        type: object
                      keepAlive:
                        description: Keep Alive Settings.
                        properties:
                          tcp:
                            description: TCP Keep Alive settings associated with the
                              upstream and downstream TCP connections.
                            properties:
                              downstream:
                                description: TCP Keep Alive Settings associated with
                                  the downstream (client) connection.
                                properties:
                                  idleTime:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  interval:
                                    description: The number of seconds between keep-alive
                                      probes.
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  probes:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                type: object
                              upstream:
                                description: TCP Keep Alive Settings associated with
                                  the upstream (backend) connection.
                                properties:
                                  idleTime:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  interval:
                                    description: The number of seconds between keep-alive
                                      probes.
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  probes:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                type: object
                            type: object
                        type: object
                      tcpKeepalive:
                        description: Deprecated.
                        nullable: true
                        type: boolean
                    type: object
                type: object
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: workspaces.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: Workspace
    listKind: WorkspaceList
    plural: workspaces
    shortNames:
    - twk
    singular: workspace
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.privileged
      name: Privileged
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: A Workspace is a collection of related namespaces in one
              or more clusters.
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              namespaceSelector:
                description: Set of namespaces owned exclusively by this workspace.
                properties:
                  names:
                    items:
                      type: string
                    type: array
                type: object
              privileged:
                nullable: true
                type: boolean
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: workspacesettings.tsb.tetrate.io
spec:
  group: tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    kind: WorkspaceSetting
    listKind: WorkspaceSettingList
    plural: workspacesettings
    shortNames:
    - tws
    singular: workspacesetting
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: Default security and traffic settings for all proxy workloads
              in the workspace.
            properties:
              defaultSecuritySetting:
                description: Security settings for all proxy workloads in this workspace.
                properties:
                  authentication:
                    enum:
                    - UNSET
                    - OPTIONAL
                    - REQUIRED
                    type: string
                  authenticationSettings:
                    properties:
                      http:
                        oneOf:
                        - not:
                            anyOf:
                            - properties:
                                jwt:
                                  oneOf:
                                  - not:
                                      anyOf:
                                      - required:
                                        - jwksUri
                                      - required:
                                        - jwks
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              required:
                              - jwt
                        - properties:
                            jwt:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              - required:
                                - jwksUri
                              - required:
                                - jwks
                          required:
                          - jwt
                        properties:
                          jwt:
                            properties:
                              audiences:
                                items:
                                  type: string
                                type: array
                              issuer:
                                description: Identifies the issuer that issued the
                                  JWT.
                                type: string
                              jwks:
                                description: JSON Web Key Set of public keys to validate
                                  signature of the JWT.
                                type: string
                              jwksUri:
                                type: string
                            type: object
                        type: object
                      trafficMode:
                        enum:
                        - UNSET
                        - OPTIONAL
                        - REQUIRED
                        type: string
                    type: object
                  authorization:
                    properties:
                      http:
                        description: This is for configuring HTTP request authorization.
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - external
                            - required:
                              - local
                        - required:
                          - external
                        - required:
                          - local
                        properties:
                          external:
                            properties:
                              includeRequestHeaders:
                                items:
                                  type: string
                                type: array
                              tls:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - files
                                - required:
                                  - files
                                properties:
                                  files:
                                    properties:
                                      caCertificates:
                                        type: string
                                      clientCertificate:
                                        description: Certificate file to authenticate
                                          the client.
                                        type: string
                                      privateKey:
                                        description: Private key file associated with
                                          the client certificate.
                                        type: string
                                    type: object
                                  mode:
                                    enum:
                                    - DISABLED
                                    - SIMPLE
                                    - MUTUAL
                                    type: string
                                  subjectAltNames:
                                    items:
                                      type: string
                                    type: array
                                type: object
                              uri:
                                type: string
                            type: object
                          local:
                            properties:
                              rules:
                                items:
                                  properties:
                                    from:
                                      items:
                                        properties:
                                          jwt:
                                            description: JWT configuration to identity
                                              the subject.
                                            properties:
                                              iss:
                                                type: string
                                              other:
                                                additionalProperties:
                                                  type: string
                                                description: A set of arbitrary claims
                                                  that are required to qualify the
                                                  subject.
                                                type: object
                                              sub:
                                                type: string
                                            type: object
                                        type: object
                                      type: array
                                    name:
                                      description: A friendly name to identify the
                                        binding.
                                      type: string
                                    to:
                                      items:
                                        properties:
                                          methods:
                                            description: The HTTP methods that are
                                              allowed by this rule.
                                            items:
                                              type: string
                                            type: array
                                          paths:
                                            description: The request path where the
                                              request is made against.
                                            items:
                                              type: string
                                            type: array
                                        type: object
                                      type: array
                                  type: object
                                type: array
                            type: object
                        type: object
                      mode:
                        description: A short cut for specifying the set of allowed
                          callers.
                        enum:
                        - UNSET
                        - NAMESPACE
                        - GROUP
                        - WORKSPACE
                        - CLUSTER
                        - DISABLED
                        - CUSTOM
                        - RULES
                        type: string
                      rules:
                        properties:
                          allow:
                            description: Allow specifies a list of rules.
                            items:
                              properties:
                                from:
                                  description: From specifies the source of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the source of a request.
                                      type: string
                                  type: object
                                to:
                                  description: To specifies the destination of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the destination of a
                                        request.
                                      type: string
                                  type: object
                              type: object
                            type: array
                          deny:
                            description: Deny specifies a list of rules.
                            items:
                              properties:
                                from:
                                  description: From specifies the source of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the source of a request.
                                      type: string
                                  type: object
                                to:
                                  description: To specifies the destination of a request.
                                  properties:
                                    fqn:
                                      description: The target resource identified
                                        by FQN which will be the destination of a
                                        request.
                                      type: string
                                  type: object
                              type: object
                            type: array
                          denyAll:
                            description: Deny all specifies whether all requests should
                              be rejected.
                            type: boolean
                        type: object
                      serviceAccounts:
                        items:
                          type: string
                        type: array
                    type: object
                  description:
                    description: A description of the resource.
                    type: string
                  displayName:
                    description: User friendly name for the resource.
                    type: string
                  etag:
                    description: The etag for the resource.
                    type: string
                  fqn:
                    description: Fully-qualified name of the resource.
                    type: string
                  propagationStrategy:
                    enum:
                    - REPLACE
                    - STRICTER
                    type: string
                  wafSettings:
                    description: 'NOTICE: this feature is in alpha stage and under
                      active development.'
                    properties:
                      ruleEngineMode:
                        description: Ad-hoc settings to switch ModSecurity engine
                          mode.
                        enum:
                        - "OFF"
                        - "ON"
                        - DETECTION_ONLY
                        type: string
                      ruleSets:
                        description: Rulesets to enable.
                        items:
                          type: string
                        type: array
                    type: object
                type: object
              defaultTrafficSetting:
                description: Traffic settings for all proxy workloads in this workspace.
                properties:
                  description:
                    description: A description of the resource.
                    type: string
                  displayName:
                    description: User friendly name for the resource.
                    type: string
                  egress:
                    properties:
                      host:
                        description: Specifies the egress gateway hostname.
                        type: string
                      port:
                        description: Deprecated.
                        format: int32
                        type: integer
                    type: object
                  etag:
                    description: The etag for the resource.
                    type: string
                  fqn:
                    description: Fully-qualified name of the resource.
                    type: string
                  rateLimiting:
                    description: Configuration for rate limiting requests.
                    oneOf:
                    - not:
                        anyOf:
                        - required:
                          - settings
                        - required:
                          - externalService
                    - required:
                      - settings
                    - required:
                      - externalService
                    properties:
                      externalService:
                        description: Configure ratelimiting using an external ratelimit
                          server.
                        properties:
                          domain:
                            description: The rate limit domain to use when calling
                              the rate limit service.
                            type: string
                          failClosed:
                            type: boolean
                          rateLimitServerUri:
                            description: The URI at which the external rate limit
                              server can be reached.
                            type: string
                          rules:
                            description: A set of rate limit rules.
                            items:
                              properties:
                                dimensions:
                                  description: A list of dimensions that are to be
                                    applied for this rate limit configuration.
                                  items:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - sourceCluster
                                        - required:
                                          - destinationCluster
                                        - required:
                                          - remoteAddress
                                        - required:
                                          - requestHeaders
                                        - required:
                                          - headerValueMatch
                                    - required:
                                      - sourceCluster
                                    - required:
                                      - destinationCluster
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - requestHeaders
                                    - required:
                                      - headerValueMatch
                                    properties:
                                      destinationCluster:
                                        description: Rate limit on destination envoy
                                          cluster.
                                        type: object
                                      headerValueMatch:
                                        description: Rate limit on the existence of
                                          certain request headers.
                                        properties:
                                          descriptorValue:
                                            description: The value to use in the descriptor
                                              entry.
                                            type: string
                                          headers:
                                            additionalProperties:
                                              oneOf:
                                              - not:
                                                  anyOf:
                                                  - required:
                                                    - exact
                                                  - required:
                                                    - prefix
                                                  - required:
                                                    - regex
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                              properties:
                                                exact:
                                                  description: Exact string match.
                                                  type: string
                                                prefix:
                                                  description: Prefix-based match.
                                                  type: string
                                                regex:
                                                  description: ECMAscript style regex-based
                                                    match.
                                                  type: string
                                              type: object
                                            type: object
                                        type: object
                                      remoteAddress:
                                        description: Rate limit on remote address
                                          of client.
                                        type: object
                                      requestHeaders:
                                        description: Rate limit on the value of certain
                                          request headers.
                                        properties:
                                          descriptorKey:
                                            description: The key to use in the descriptor
                                              entry.
                                            type: string
                                          headerName:
                                            description: The header name to be queried
                                              from the request headers.
                                            type: string
                                        type: object
                                      sourceCluster:
                                        description: Rate limit on source envoy cluster.
                                        type: object
                                    type: object
                                  type: array
                              type: object
                            type: array
                          timeout:
                            description: The timeout in seconds for the external rate
                              limit server RPC.
                            type: string
                          tls:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - files
                            - required:
                              - files
                            properties:
                              files:
                                properties:
                                  caCertificates:
                                    type: string
                                  clientCertificate:
                                    description: Certificate file to authenticate
                                      the client.
                                    type: string
                                  privateKey:
                                    description: Private key file associated with
                                      the client certificate.
                                    type: string
                                type: object
                              mode:
                                enum:
                                - DISABLED
                                - SIMPLE
                                - MUTUAL
                                type: string
                              subjectAltNames:
                                items:
                                  type: string
                                type: array
                            type: object
                        type: object
                      settings:
                        properties:
                          failClosed:
                            type: boolean
                          rules:
                            description: A list of rules for ratelimiting.
                            items:
                              properties:
                                dimensions:
                                  description: A list of dimensions to define each
                                    ratelimit rule.
                                  items:
                                    oneOf:
                                    - not:
                                        anyOf:
                                        - required:
                                          - remoteAddress
                                        - required:
                                          - header
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - header
                                    properties:
                                      header:
                                        description: Rate limit on certain HTTP headers.
                                        properties:
                                          name:
                                            description: Name of the header to match
                                              on.
                                            type: string
                                          value:
                                            description: Value of the header to match
                                              on if matching on a specific value.
                                            oneOf:
                                            - not:
                                                anyOf:
                                                - required:
                                                  - exact
                                                - required:
                                                  - prefix
                                                - required:
                                                  - regex
                                            - required:
                                              - exact
                                            - required:
                                              - prefix
                                            - required:
                                              - regex
                                            properties:
                                              exact:
                                                description: Exact string match.
                                                type: string
                                              prefix:
                                                description: Prefix-based match.
                                                type: string
                                              regex:
                                                description: ECMAscript style regex-based
                                                  match.
                                                type: string
                                            type: object
                                        type: object
                                      remoteAddress:
                                        description: Rate limit on the remote address
                                          of client.
                                        properties:
                                          value:
                                            description: Ratelimit on a specific remote
                                              address.
                                            type: string
                                        type: object
                                    type: object
                                  type: array
                                limit:
                                  description: The ratelimit value that will be configured
                                    for the above rules.
                                  properties:
                                    requestsPerUnit:
                                      description: Specifies the value of the rate
                                        limit.
                                      maximum: 4294967295
                                      minimum: 0
                                      type: integer
                                    unit:
                                      description: Specifies the unit of time for
                                        rate limit.
                                      enum:
                                      - UNKNOWN
                                      - SECOND
                                      - MINUTE
                                      - HOUR
                                      - DAY
                                      type: string
                                  type: object
                              type: object
                            type: array
                          timeout:
                            description: The timeout in seconds for the rate limit
                              server RPC.
                            type: string
                        type: object
                    type: object
                  reachability:
                    properties:
                      hosts:
                        items:
                          type: string
                        type: array
                      mode:
                        description: A short cut for specifying the set of services
                          accessed by the workload.
                        enum:
                        - UNSET
                        - NAMESPACE
                        - GROUP
                        - WORKSPACE
                        - CLUSTER
                        - CUSTOM
                        type: string
                    type: object
                  resilience:
                    properties:
                      circuitBreakerSensitivity:
                        enum:
                        - UNSET
                        - LOW
                        - MEDIUM
                        - HIGH
                        type: string
                      httpRequestTimeout:
                        description: Timeout for HTTP requests.
                        type: string
                      httpRetries:
                        description: Retry policy for HTTP requests.
                        properties:
                          attempts:
                            description: Number of retries for a given request.
                            format: int32
                            type: integer
                          perTryTimeout:
                            description: Timeout per retry attempt for a given request.
                            type: string
                          retryOn:
                            description: Specifies the conditions under which retry
                              takes place.
                            type: string
                        type: object
                      keepAlive:
                        description: Keep Alive Settings.
                        properties:
                          tcp:
                            description: TCP Keep Alive settings associated with the
                              upstream and downstream TCP connections.
                            properties:
                              downstream:
                                description: TCP Keep Alive Settings associated with
                                  the downstream (client) connection.
                                properties:
                                  idleTime:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  interval:
                                    description: The number of seconds between keep-alive
                                      probes.
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  probes:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                type: object
                              upstream:
                                description: TCP Keep Alive Settings associated with
                                  the upstream (backend) connection.
                                properties:
                                  idleTime:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  interval:
                                    description: The number of seconds between keep-alive
                                      probes.
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                  probes:
                                    maximum: 4294967295
                                    minimum: 0
                                    nullable: true
                                    type: integer
                                type: object
                            type: object
                        type: object
                      tcpKeepalive:
                        description: Deprecated.
                        nullable: true
                        type: boolean
                    type: object
                type: object
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              regionalFailover:
                description: Locality routing settings for all gateways in the workspace.
                items:
                  properties:
                    from:
                      description: Originating region.
                      type: string
                    to:
                      type: string
                  type: object
                type: array
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: apis.application.tsb.tetrate.io
spec:
  group: application.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - application-tsb-tetrate-io
    kind: API
    listKind: APIList
    plural: apis
    shortNames:
    - tapi
    singular: api
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/application']
      name: Application
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: An API configuring a set of servers and endpoints that expose
              the Application business logic.
            properties:
              configResources:
                description: The configuration resources that are related to this
                  API object.
                items:
                  properties:
                    exclusivelyOwned:
                      type: boolean
                    expectedEtag:
                      type: string
                    fqn:
                      description: The FQN of the resource this status is computed
                        for.
                      type: string
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              endpoints:
                description: List of endpoints exposed by this API.
                items:
                  properties:
                    hostnames:
                      description: The list of hostnames where this endpoint is exposed.
                      items:
                        type: string
                      type: array
                    methods:
                      description: The list of HTTP methods this endpoint supports.
                      items:
                        type: string
                      type: array
                    path:
                      description: The HTTP path of the endpoint, relative to the
                        hostnames exposed by the API.
                      type: string
                    service:
                      description: The FQN of the service in the service registry
                        that is exposing this endpoint.
                      type: string
                  type: object
                type: array
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              openapi:
                description: The raw OpenAPI spec for this API.
                type: string
              servers:
                description: List of servers that expose the API.
                items:
                  properties:
                    authentication:
                      description: Configuration to authenticate clients.
                      oneOf:
                      - not:
                          anyOf:
                          - properties:
                              jwt:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - jwksUri
                                    - required:
                                      - jwks
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            required:
                            - jwt
                      - properties:
                          jwt:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            - required:
                              - jwksUri
                            - required:
                              - jwks
                        required:
                        - jwt
                      properties:
                        jwt:
                          properties:
                            audiences:
                              items:
                                type: string
                              type: array
                            issuer:
                              description: Identifies the issuer that issued the JWT.
                              type: string
                            jwks:
                              description: JSON Web Key Set of public keys to validate
                                signature of the JWT.
                              type: string
                            jwksUri:
                              type: string
                          type: object
                      type: object
                    authorization:
                      description: Configuration to authorize a request.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - external
                          - required:
                            - local
                      - required:
                        - external
                      - required:
                        - local
                      properties:
                        external:
                          properties:
                            includeRequestHeaders:
                              items:
                                type: string
                              type: array
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                            uri:
                              type: string
                          type: object
                        local:
                          properties:
                            rules:
                              items:
                                properties:
                                  from:
                                    items:
                                      properties:
                                        jwt:
                                          description: JWT configuration to identity
                                            the subject.
                                          properties:
                                            iss:
                                              type: string
                                            other:
                                              additionalProperties:
                                                type: string
                                              description: A set of arbitrary claims
                                                that are required to qualify the subject.
                                              type: object
                                            sub:
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  name:
                                    description: A friendly name to identify the binding.
                                    type: string
                                  to:
                                    items:
                                      properties:
                                        methods:
                                          description: The HTTP methods that are allowed
                                            by this rule.
                                          items:
                                            type: string
                                          type: array
                                        paths:
                                          description: The request path where the
                                            request is made against.
                                          items:
                                            type: string
                                          type: array
                                      type: object
                                    type: array
                                type: object
                              type: array
                          type: object
                      type: object
                    hostname:
                      description: Hostname with which the service can be expected
                        to be accessed by clients.
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    rateLimiting:
                      description: Configuration for rate limiting requests.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - settings
                          - required:
                            - externalService
                      - required:
                        - settings
                      - required:
                        - externalService
                      properties:
                        externalService:
                          description: Configure ratelimiting using an external ratelimit
                            server.
                          properties:
                            domain:
                              description: The rate limit domain to use when calling
                                the rate limit service.
                              type: string
                            failClosed:
                              type: boolean
                            rateLimitServerUri:
                              description: The URI at which the external rate limit
                                server can be reached.
                              type: string
                            rules:
                              description: A set of rate limit rules.
                              items:
                                properties:
                                  dimensions:
                                    description: A list of dimensions that are to
                                      be applied for this rate limit configuration.
                                    items:
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - sourceCluster
                                          - required:
                                            - destinationCluster
                                          - required:
                                            - remoteAddress
                                          - required:
                                            - requestHeaders
                                          - required:
                                            - headerValueMatch
                                      - required:
                                        - sourceCluster
                                      - required:
                                        - destinationCluster
                                      - required:
                                        - remoteAddress
                                      - required:
                                        - requestHeaders
                                      - required:
                                        - headerValueMatch
                                      properties:
                                        destinationCluster:
                                          description: Rate limit on destination envoy
                                            cluster.
                                          type: object
                                        headerValueMatch:
                                          description: Rate limit on the existence
                                            of certain request headers.
                                          properties:
                                            descriptorValue:
                                              description: The value to use in the
                                                descriptor entry.
                                              type: string
                                            headers:
                                              additionalProperties:
                                                oneOf:
                                                - not:
                                                    anyOf:
                                                    - required:
                                                      - exact
                                                    - required:
                                                      - prefix
                                                    - required:
                                                      - regex
                                                - required:
                                                  - exact
                                                - required:
                                                  - prefix
                                                - required:
                                                  - regex
                                                properties:
                                                  exact:
                                                    description: Exact string match.
                                                    type: string
                                                  prefix:
                                                    description: Prefix-based match.
                                                    type: string
                                                  regex:
                                                    description: ECMAscript style
                                                      regex-based match.
                                                    type: string
                                                type: object
                                              type: object
                                          type: object
                                        remoteAddress:
                                          description: Rate limit on remote address
                                            of client.
                                          type: object
                                        requestHeaders:
                                          description: Rate limit on the value of
                                            certain request headers.
                                          properties:
                                            descriptorKey:
                                              description: The key to use in the descriptor
                                                entry.
                                              type: string
                                            headerName:
                                              description: The header name to be queried
                                                from the request headers.
                                              type: string
                                          type: object
                                        sourceCluster:
                                          description: Rate limit on source envoy
                                            cluster.
                                          type: object
                                      type: object
                                    type: array
                                type: object
                              type: array
                            timeout:
                              description: The timeout in seconds for the external
                                rate limit server RPC.
                              type: string
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                          type: object
                        settings:
                          properties:
                            failClosed:
                              type: boolean
                            rules:
                              description: A list of rules for ratelimiting.
                              items:
                                properties:
                                  dimensions:
                                    description: A list of dimensions to define each
                                      ratelimit rule.
                                    items:
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - remoteAddress
                                          - required:
                                            - header
                                      - required:
                                        - remoteAddress
                                      - required:
                                        - header
                                      properties:
                                        header:
                                          description: Rate limit on certain HTTP
                                            headers.
                                          properties:
                                            name:
                                              description: Name of the header to match
                                                on.
                                              type: string
                                            value:
                                              description: Value of the header to
                                                match on if matching on a specific
                                                value.
                                              oneOf:
                                              - not:
                                                  anyOf:
                                                  - required:
                                                    - exact
                                                  - required:
                                                    - prefix
                                                  - required:
                                                    - regex
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                              properties:
                                                exact:
                                                  description: Exact string match.
                                                  type: string
                                                prefix:
                                                  description: Prefix-based match.
                                                  type: string
                                                regex:
                                                  description: ECMAscript style regex-based
                                                    match.
                                                  type: string
                                              type: object
                                          type: object
                                        remoteAddress:
                                          description: Rate limit on the remote address
                                            of client.
                                          properties:
                                            value:
                                              description: Ratelimit on a specific
                                                remote address.
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  limit:
                                    description: The ratelimit value that will be
                                      configured for the above rules.
                                    properties:
                                      requestsPerUnit:
                                        description: Specifies the value of the rate
                                          limit.
                                        maximum: 4294967295
                                        minimum: 0
                                        type: integer
                                      unit:
                                        description: Specifies the unit of time for
                                          rate limit.
                                        enum:
                                        - UNKNOWN
                                        - SECOND
                                        - MINUTE
                                        - HOUR
                                        - DAY
                                        type: string
                                    type: object
                                type: object
                              type: array
                            timeout:
                              description: The timeout in seconds for the rate limit
                                server RPC.
                              type: string
                          type: object
                      type: object
                    routing:
                      description: Routing rules associated with HTTP traffic to this
                        service.
                      properties:
                        corsPolicy:
                          description: Cross origin resource request policy settings
                            for all routes.
                          properties:
                            allowCredentials:
                              nullable: true
                              type: boolean
                            allowHeaders:
                              description: List of HTTP headers that can be used when
                                requesting the resource.
                              items:
                                type: string
                              type: array
                            allowMethods:
                              description: List of HTTP methods allowed to access
                                the resource.
                              items:
                                type: string
                              type: array
                            allowOrigin:
                              description: The list of origins that are allowed to
                                perform CORS requests.
                              items:
                                type: string
                              type: array
                            exposeHeaders:
                              description: A white list of HTTP headers that the browsers
                                are allowed to access.
                              items:
                                type: string
                              type: array
                            maxAge:
                              description: Specifies how long the results of a preflight
                                request can be cached.
                              type: string
                          type: object
                        rules:
                          description: HTTP routes.
                          items:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - route
                                - required:
                                  - redirect
                            - required:
                              - route
                            - required:
                              - redirect
                            properties:
                              match:
                                description: One or more match conditions (OR-ed).
                                items:
                                  properties:
                                    headers:
                                      additionalProperties:
                                        oneOf:
                                        - not:
                                            anyOf:
                                            - required:
                                              - exact
                                            - required:
                                              - prefix
                                            - required:
                                              - regex
                                        - required:
                                          - exact
                                        - required:
                                          - prefix
                                        - required:
                                          - regex
                                        properties:
                                          exact:
                                            description: Exact string match.
                                            type: string
                                          prefix:
                                            description: Prefix-based match.
                                            type: string
                                          regex:
                                            description: ECMAscript style regex-based
                                              match.
                                            type: string
                                        type: object
                                      description: The header keys must be lowercase
                                        and use hyphen as the separator, e.g.
                                      type: object
                                    uri:
                                      description: URI to match.
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - exact
                                          - required:
                                            - prefix
                                          - required:
                                            - regex
                                      - required:
                                        - exact
                                      - required:
                                        - prefix
                                      - required:
                                        - regex
                                      properties:
                                        exact:
                                          description: Exact string match.
                                          type: string
                                        prefix:
                                          description: Prefix-based match.
                                          type: string
                                        regex:
                                          description: ECMAscript style regex-based
                                            match.
                                          type: string
                                      type: object
                                  type: object
                                type: array
                              modify:
                                description: One or more mutations to be performed
                                  before forwarding.
                                properties:
                                  headers:
                                    description: Add/remove/overwrite one or more
                                      HTTP headers in a request or response.
                                    properties:
                                      request:
                                        description: Header manipulation rules to
                                          apply before forwarding a request to the
                                          destination service.
                                        properties:
                                          add:
                                            additionalProperties:
                                              type: string
                                            type: object
                                          remove:
                                            description: Remove a the specified headers.
                                            items:
                                              type: string
                                            type: array
                                          set:
                                            additionalProperties:
                                              type: string
                                            description: Overwrite the headers specified
                                              by key with the given values.
                                            type: object
                                        type: object
                                      response:
                                        description: Header manipulation rules to
                                          apply before returning a response to the
                                          caller.
                                        properties:
                                          add:
                                            additionalProperties:
                                              type: string
                                            type: object
                                          remove:
                                            description: Remove a the specified headers.
                                            items:
                                              type: string
                                            type: array
                                          set:
                                            additionalProperties:
                                              type: string
                                            description: Overwrite the headers specified
                                              by key with the given values.
                                            type: object
                                        type: object
                                    type: object
                                  rewrite:
                                    description: Rewrite the HTTP Host or URL or both.
                                    properties:
                                      authority:
                                        description: Rewrite the Authority/Host header
                                          with this value.
                                        type: string
                                      uri:
                                        description: Rewrite the path (or the prefix)
                                          portion of the URI with this value.
                                        type: string
                                    type: object
                                type: object
                              redirect:
                                description: Redirect the request to a different host
                                  or URL or both.
                                properties:
                                  authority:
                                    description: On a redirect, overwrite the Authority/Host
                                      portion of the URL with this value.
                                    type: string
                                  port:
                                    maximum: 4294967295
                                    minimum: 0
                                    type: integer
                                  redirectCode:
                                    maximum: 4294967295
                                    minimum: 0
                                    type: integer
                                  scheme:
                                    description: On a redirect, overwrite the scheme
                                      with this one.
                                    type: string
                                  uri:
                                    description: On a redirect, overwrite the Path
                                      portion of the URL with this value.
                                    type: string
                                type: object
                              route:
                                description: Forward the request to the specified
                                  destination(s).
                                properties:
                                  host:
                                    type: string
                                  port:
                                    description: The port on the service to forward
                                      the request to.
                                    maximum: 4294967295
                                    minimum: 0
                                    type: integer
                                type: object
                            type: object
                          type: array
                      type: object
                    tls:
                      description: TLS certificate info.
                      properties:
                        files:
                          properties:
                            caCertificates:
                              type: string
                            privateKey:
                              type: string
                            serverCertificate:
                              type: string
                          type: object
                        mode:
                          enum:
                          - DISABLED
                          - SIMPLE
                          - MUTUAL
                          type: string
                        secretName:
                          type: string
                      type: object
                    xxxOldAuthentication:
                      oneOf:
                      - not:
                          anyOf:
                          - properties:
                              jwt:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - jwksUri
                                    - required:
                                      - jwks
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            required:
                            - jwt
                      - properties:
                          jwt:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            - required:
                              - jwksUri
                            - required:
                              - jwks
                        required:
                        - jwt
                      properties:
                        jwt:
                          properties:
                            audiences:
                              items:
                                type: string
                              type: array
                            issuer:
                              description: Identifies the issuer that issued the JWT.
                              type: string
                            jwks:
                              description: JSON Web Key Set of public keys to validate
                                signature of the JWT.
                              type: string
                            jwksUri:
                              type: string
                          type: object
                      type: object
                    xxxOldAuthorization:
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - external
                          - required:
                            - local
                      - required:
                        - external
                      - required:
                        - local
                      properties:
                        external:
                          properties:
                            includeRequestHeaders:
                              items:
                                type: string
                              type: array
                            uri:
                              type: string
                          type: object
                        local:
                          properties:
                            rules:
                              items:
                                properties:
                                  from:
                                    items:
                                      properties:
                                        jwt:
                                          description: JWT configuration to identity
                                            the subject.
                                          properties:
                                            iss:
                                              type: string
                                            other:
                                              additionalProperties:
                                                type: string
                                              description: A set of arbitrary claims
                                                that are required to qualify the subject.
                                              type: object
                                            sub:
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  name:
                                    description: A friendly name to identify the binding.
                                    type: string
                                  to:
                                    items:
                                      properties:
                                        methods:
                                          description: The HTTP methods that are allowed
                                            by this rule.
                                          items:
                                            type: string
                                          type: array
                                        paths:
                                          description: The request path where the
                                            request is made against.
                                          items:
                                            type: string
                                          type: array
                                      type: object
                                    type: array
                                type: object
                              type: array
                          type: object
                      type: object
                  type: object
                type: array
              workloadSelector:
                properties:
                  labels:
                    additionalProperties:
                      type: string
                    type: object
                  namespace:
                    description: The namespace where the workload resides.
                    type: string
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: applications.application.tsb.tetrate.io
spec:
  group: application.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - application-tsb-tetrate-io
    kind: Application
    listKind: ApplicationList
    plural: applications
    shortNames:
    - tapp
    singular: application
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            oneOf:
            - not:
                anyOf:
                - required:
                  - namespaceSelector
                - required:
                  - gatewayGroup
            - required:
              - namespaceSelector
            - required:
              - gatewayGroup
            properties:
              configResources:
                description: The configuration resources that are related to this
                  Application.
                items:
                  properties:
                    exclusivelyOwned:
                      type: boolean
                    expectedEtag:
                      type: string
                    fqn:
                      description: The FQN of the resource this status is computed
                        for.
                      type: string
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              gatewayGroup:
                description: Optional FQN of the Gateway Group to be used by the application.
                type: string
              namespaceSelector:
                description: Optional set of namespaces this application can configure.
                properties:
                  names:
                    items:
                      type: string
                    type: array
                type: object
              services:
                description: Optional list of services that are part of the application.
                items:
                  type: string
                type: array
              workspace:
                description: FQN of the workspace this application is part of.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: egressgateways.gateway.tsb.tetrate.io
spec:
  group: gateway.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - gateway-tsb-tetrate-io
    kind: EgressGateway
    listKind: EgressGatewayList
    plural: egressgateways
    shortNames:
    - teg
    singular: egressgateway
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/gatewayGroup']
      name: Gateway-Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`EgressGateway` configures a workload to act as an egress
              gateway in the mesh.'
            properties:
              authorization:
                description: The description of which service accounts can access
                  which hosts.
                items:
                  properties:
                    from:
                      description: The workloads or service accounts this authorization
                        rule applies to.
                      properties:
                        http:
                          description: This is for configuring HTTP request authorization.
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - external
                              - required:
                                - local
                          - required:
                            - external
                          - required:
                            - local
                          properties:
                            external:
                              properties:
                                includeRequestHeaders:
                                  items:
                                    type: string
                                  type: array
                                tls:
                                  oneOf:
                                  - not:
                                      anyOf:
                                      - required:
                                        - files
                                  - required:
                                    - files
                                  properties:
                                    files:
                                      properties:
                                        caCertificates:
                                          type: string
                                        clientCertificate:
                                          description: Certificate file to authenticate
                                            the client.
                                          type: string
                                        privateKey:
                                          description: Private key file associated
                                            with the client certificate.
                                          type: string
                                      type: object
                                    mode:
                                      enum:
                                      - DISABLED
                                      - SIMPLE
                                      - MUTUAL
                                      type: string
                                    subjectAltNames:
                                      items:
                                        type: string
                                      type: array
                                  type: object
                                uri:
                                  type: string
                              type: object
                            local:
                              properties:
                                rules:
                                  items:
                                    properties:
                                      from:
                                        items:
                                          properties:
                                            jwt:
                                              description: JWT configuration to identity
                                                the subject.
                                              properties:
                                                iss:
                                                  type: string
                                                other:
                                                  additionalProperties:
                                                    type: string
                                                  description: A set of arbitrary
                                                    claims that are required to qualify
                                                    the subject.
                                                  type: object
                                                sub:
                                                  type: string
                                              type: object
                                          type: object
                                        type: array
                                      name:
                                        description: A friendly name to identify the
                                          binding.
                                        type: string
                                      to:
                                        items:
                                          properties:
                                            methods:
                                              description: The HTTP methods that are
                                                allowed by this rule.
                                              items:
                                                type: string
                                              type: array
                                            paths:
                                              description: The request path where
                                                the request is made against.
                                              items:
                                                type: string
                                              type: array
                                          type: object
                                        type: array
                                    type: object
                                  type: array
                              type: object
                          type: object
                        mode:
                          description: A short cut for specifying the set of allowed
                            callers.
                          enum:
                          - UNSET
                          - NAMESPACE
                          - GROUP
                          - WORKSPACE
                          - CLUSTER
                          - DISABLED
                          - CUSTOM
                          - RULES
                          type: string
                        rules:
                          properties:
                            allow:
                              description: Allow specifies a list of rules.
                              items:
                                properties:
                                  from:
                                    description: From specifies the source of a request.
                                    properties:
                                      fqn:
                                        description: The target resource identified
                                          by FQN which will be the source of a request.
                                        type: string
                                    type: object
                                  to:
                                    description: To specifies the destination of a
                                      request.
                                    properties:
                                      fqn:
                                        description: The target resource identified
                                          by FQN which will be the destination of
                                          a request.
                                        type: string
                                    type: object
                                type: object
                              type: array
                            deny:
                              description: Deny specifies a list of rules.
                              items:
                                properties:
                                  from:
                                    description: From specifies the source of a request.
                                    properties:
                                      fqn:
                                        description: The target resource identified
                                          by FQN which will be the source of a request.
                                        type: string
                                    type: object
                                  to:
                                    description: To specifies the destination of a
                                      request.
                                    properties:
                                      fqn:
                                        description: The target resource identified
                                          by FQN which will be the destination of
                                          a request.
                                        type: string
                                    type: object
                                type: object
                              type: array
                            denyAll:
                              description: Deny all specifies whether all requests
                                should be rejected.
                              type: boolean
                          type: object
                        serviceAccounts:
                          items:
                            type: string
                          type: array
                      type: object
                    to:
                      description: The external hostnames the workload(s) described
                        in this rule can access.
                      items:
                        type: string
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              workloadSelector:
                properties:
                  labels:
                    additionalProperties:
                      type: string
                    type: object
                  namespace:
                    description: The namespace where the workload resides.
                    type: string
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: groups.gateway.tsb.tetrate.io
spec:
  group: gateway.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - gateway-tsb-tetrate-io
    kind: Group
    listKind: GroupList
    plural: groups
    shortNames:
    - tgg
    singular: group
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.configMode
      name: Mode
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              configMode:
                enum:
                - BRIDGED
                - DIRECT
                type: string
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              namespaceSelector:
                description: Set of namespaces owned exclusively by this group.
                properties:
                  names:
                    items:
                      type: string
                    type: array
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: ingressgateways.gateway.tsb.tetrate.io
spec:
  group: gateway.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - gateway-tsb-tetrate-io
    kind: IngressGateway
    listKind: IngressGatewayList
    plural: ingressgateways
    shortNames:
    - tig
    singular: ingressgateway
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/gatewayGroup']
      name: Gateway-Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`IngressGateway` configures a workload to act as an ingress
              gateway into the mesh.'
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              http:
                description: One or more HTTP or HTTPS servers exposed by the gateway.
                items:
                  properties:
                    authentication:
                      description: Configuration to authenticate clients.
                      oneOf:
                      - not:
                          anyOf:
                          - properties:
                              jwt:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - jwksUri
                                    - required:
                                      - jwks
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            required:
                            - jwt
                      - properties:
                          jwt:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            - required:
                              - jwksUri
                            - required:
                              - jwks
                        required:
                        - jwt
                      properties:
                        jwt:
                          properties:
                            audiences:
                              items:
                                type: string
                              type: array
                            issuer:
                              description: Identifies the issuer that issued the JWT.
                              type: string
                            jwks:
                              description: JSON Web Key Set of public keys to validate
                                signature of the JWT.
                              type: string
                            jwksUri:
                              type: string
                          type: object
                      type: object
                    authorization:
                      description: Configuration to authorize a request.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - external
                          - required:
                            - local
                      - required:
                        - external
                      - required:
                        - local
                      properties:
                        external:
                          properties:
                            includeRequestHeaders:
                              items:
                                type: string
                              type: array
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                            uri:
                              type: string
                          type: object
                        local:
                          properties:
                            rules:
                              items:
                                properties:
                                  from:
                                    items:
                                      properties:
                                        jwt:
                                          description: JWT configuration to identity
                                            the subject.
                                          properties:
                                            iss:
                                              type: string
                                            other:
                                              additionalProperties:
                                                type: string
                                              description: A set of arbitrary claims
                                                that are required to qualify the subject.
                                              type: object
                                            sub:
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  name:
                                    description: A friendly name to identify the binding.
                                    type: string
                                  to:
                                    items:
                                      properties:
                                        methods:
                                          description: The HTTP methods that are allowed
                                            by this rule.
                                          items:
                                            type: string
                                          type: array
                                        paths:
                                          description: The request path where the
                                            request is made against.
                                          items:
                                            type: string
                                          type: array
                                      type: object
                                    type: array
                                type: object
                              type: array
                          type: object
                      type: object
                    hostname:
                      description: Hostname with which the service can be expected
                        to be accessed by clients.
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    rateLimiting:
                      description: Configuration for rate limiting requests.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - settings
                          - required:
                            - externalService
                      - required:
                        - settings
                      - required:
                        - externalService
                      properties:
                        externalService:
                          description: Configure ratelimiting using an external ratelimit
                            server.
                          properties:
                            domain:
                              description: The rate limit domain to use when calling
                                the rate limit service.
                              type: string
                            failClosed:
                              type: boolean
                            rateLimitServerUri:
                              description: The URI at which the external rate limit
                                server can be reached.
                              type: string
                            rules:
                              description: A set of rate limit rules.
                              items:
                                properties:
                                  dimensions:
                                    description: A list of dimensions that are to
                                      be applied for this rate limit configuration.
                                    items:
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - sourceCluster
                                          - required:
                                            - destinationCluster
                                          - required:
                                            - remoteAddress
                                          - required:
                                            - requestHeaders
                                          - required:
                                            - headerValueMatch
                                      - required:
                                        - sourceCluster
                                      - required:
                                        - destinationCluster
                                      - required:
                                        - remoteAddress
                                      - required:
                                        - requestHeaders
                                      - required:
                                        - headerValueMatch
                                      properties:
                                        destinationCluster:
                                          description: Rate limit on destination envoy
                                            cluster.
                                          type: object
                                        headerValueMatch:
                                          description: Rate limit on the existence
                                            of certain request headers.
                                          properties:
                                            descriptorValue:
                                              description: The value to use in the
                                                descriptor entry.
                                              type: string
                                            headers:
                                              additionalProperties:
                                                oneOf:
                                                - not:
                                                    anyOf:
                                                    - required:
                                                      - exact
                                                    - required:
                                                      - prefix
                                                    - required:
                                                      - regex
                                                - required:
                                                  - exact
                                                - required:
                                                  - prefix
                                                - required:
                                                  - regex
                                                properties:
                                                  exact:
                                                    description: Exact string match.
                                                    type: string
                                                  prefix:
                                                    description: Prefix-based match.
                                                    type: string
                                                  regex:
                                                    description: ECMAscript style
                                                      regex-based match.
                                                    type: string
                                                type: object
                                              type: object
                                          type: object
                                        remoteAddress:
                                          description: Rate limit on remote address
                                            of client.
                                          type: object
                                        requestHeaders:
                                          description: Rate limit on the value of
                                            certain request headers.
                                          properties:
                                            descriptorKey:
                                              description: The key to use in the descriptor
                                                entry.
                                              type: string
                                            headerName:
                                              description: The header name to be queried
                                                from the request headers.
                                              type: string
                                          type: object
                                        sourceCluster:
                                          description: Rate limit on source envoy
                                            cluster.
                                          type: object
                                      type: object
                                    type: array
                                type: object
                              type: array
                            timeout:
                              description: The timeout in seconds for the external
                                rate limit server RPC.
                              type: string
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                          type: object
                        settings:
                          properties:
                            failClosed:
                              type: boolean
                            rules:
                              description: A list of rules for ratelimiting.
                              items:
                                properties:
                                  dimensions:
                                    description: A list of dimensions to define each
                                      ratelimit rule.
                                    items:
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - remoteAddress
                                          - required:
                                            - header
                                      - required:
                                        - remoteAddress
                                      - required:
                                        - header
                                      properties:
                                        header:
                                          description: Rate limit on certain HTTP
                                            headers.
                                          properties:
                                            name:
                                              description: Name of the header to match
                                                on.
                                              type: string
                                            value:
                                              description: Value of the header to
                                                match on if matching on a specific
                                                value.
                                              oneOf:
                                              - not:
                                                  anyOf:
                                                  - required:
                                                    - exact
                                                  - required:
                                                    - prefix
                                                  - required:
                                                    - regex
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                              properties:
                                                exact:
                                                  description: Exact string match.
                                                  type: string
                                                prefix:
                                                  description: Prefix-based match.
                                                  type: string
                                                regex:
                                                  description: ECMAscript style regex-based
                                                    match.
                                                  type: string
                                              type: object
                                          type: object
                                        remoteAddress:
                                          description: Rate limit on the remote address
                                            of client.
                                          properties:
                                            value:
                                              description: Ratelimit on a specific
                                                remote address.
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  limit:
                                    description: The ratelimit value that will be
                                      configured for the above rules.
                                    properties:
                                      requestsPerUnit:
                                        description: Specifies the value of the rate
                                          limit.
                                        maximum: 4294967295
                                        minimum: 0
                                        type: integer
                                      unit:
                                        description: Specifies the unit of time for
                                          rate limit.
                                        enum:
                                        - UNKNOWN
                                        - SECOND
                                        - MINUTE
                                        - HOUR
                                        - DAY
                                        type: string
                                    type: object
                                type: object
                              type: array
                            timeout:
                              description: The timeout in seconds for the rate limit
                                server RPC.
                              type: string
                          type: object
                      type: object
                    routing:
                      description: Routing rules associated with HTTP traffic to this
                        service.
                      properties:
                        corsPolicy:
                          description: Cross origin resource request policy settings
                            for all routes.
                          properties:
                            allowCredentials:
                              nullable: true
                              type: boolean
                            allowHeaders:
                              description: List of HTTP headers that can be used when
                                requesting the resource.
                              items:
                                type: string
                              type: array
                            allowMethods:
                              description: List of HTTP methods allowed to access
                                the resource.
                              items:
                                type: string
                              type: array
                            allowOrigin:
                              description: The list of origins that are allowed to
                                perform CORS requests.
                              items:
                                type: string
                              type: array
                            exposeHeaders:
                              description: A white list of HTTP headers that the browsers
                                are allowed to access.
                              items:
                                type: string
                              type: array
                            maxAge:
                              description: Specifies how long the results of a preflight
                                request can be cached.
                              type: string
                          type: object
                        rules:
                          description: HTTP routes.
                          items:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - route
                                - required:
                                  - redirect
                            - required:
                              - route
                            - required:
                              - redirect
                            properties:
                              match:
                                description: One or more match conditions (OR-ed).
                                items:
                                  properties:
                                    headers:
                                      additionalProperties:
                                        oneOf:
                                        - not:
                                            anyOf:
                                            - required:
                                              - exact
                                            - required:
                                              - prefix
                                            - required:
                                              - regex
                                        - required:
                                          - exact
                                        - required:
                                          - prefix
                                        - required:
                                          - regex
                                        properties:
                                          exact:
                                            description: Exact string match.
                                            type: string
                                          prefix:
                                            description: Prefix-based match.
                                            type: string
                                          regex:
                                            description: ECMAscript style regex-based
                                              match.
                                            type: string
                                        type: object
                                      description: The header keys must be lowercase
                                        and use hyphen as the separator, e.g.
                                      type: object
                                    uri:
                                      description: URI to match.
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - exact
                                          - required:
                                            - prefix
                                          - required:
                                            - regex
                                      - required:
                                        - exact
                                      - required:
                                        - prefix
                                      - required:
                                        - regex
                                      properties:
                                        exact:
                                          description: Exact string match.
                                          type: string
                                        prefix:
                                          description: Prefix-based match.
                                          type: string
                                        regex:
                                          description: ECMAscript style regex-based
                                            match.
                                          type: string
                                      type: object
                                  type: object
                                type: array
                              modify:
                                description: One or more mutations to be performed
                                  before forwarding.
                                properties:
                                  headers:
                                    description: Add/remove/overwrite one or more
                                      HTTP headers in a request or response.
                                    properties:
                                      request:
                                        description: Header manipulation rules to
                                          apply before forwarding a request to the
                                          destination service.
                                        properties:
                                          add:
                                            additionalProperties:
                                              type: string
                                            type: object
                                          remove:
                                            description: Remove a the specified headers.
                                            items:
                                              type: string
                                            type: array
                                          set:
                                            additionalProperties:
                                              type: string
                                            description: Overwrite the headers specified
                                              by key with the given values.
                                            type: object
                                        type: object
                                      response:
                                        description: Header manipulation rules to
                                          apply before returning a response to the
                                          caller.
                                        properties:
                                          add:
                                            additionalProperties:
                                              type: string
                                            type: object
                                          remove:
                                            description: Remove a the specified headers.
                                            items:
                                              type: string
                                            type: array
                                          set:
                                            additionalProperties:
                                              type: string
                                            description: Overwrite the headers specified
                                              by key with the given values.
                                            type: object
                                        type: object
                                    type: object
                                  rewrite:
                                    description: Rewrite the HTTP Host or URL or both.
                                    properties:
                                      authority:
                                        description: Rewrite the Authority/Host header
                                          with this value.
                                        type: string
                                      uri:
                                        description: Rewrite the path (or the prefix)
                                          portion of the URI with this value.
                                        type: string
                                    type: object
                                type: object
                              redirect:
                                description: Redirect the request to a different host
                                  or URL or both.
                                properties:
                                  authority:
                                    description: On a redirect, overwrite the Authority/Host
                                      portion of the URL with this value.
                                    type: string
                                  port:
                                    maximum: 4294967295
                                    minimum: 0
                                    type: integer
                                  redirectCode:
                                    maximum: 4294967295
                                    minimum: 0
                                    type: integer
                                  scheme:
                                    description: On a redirect, overwrite the scheme
                                      with this one.
                                    type: string
                                  uri:
                                    description: On a redirect, overwrite the Path
                                      portion of the URL with this value.
                                    type: string
                                type: object
                              route:
                                description: Forward the request to the specified
                                  destination(s).
                                properties:
                                  host:
                                    type: string
                                  port:
                                    description: The port on the service to forward
                                      the request to.
                                    maximum: 4294967295
                                    minimum: 0
                                    type: integer
                                type: object
                            type: object
                          type: array
                      type: object
                    tls:
                      description: TLS certificate info.
                      properties:
                        files:
                          properties:
                            caCertificates:
                              type: string
                            privateKey:
                              type: string
                            serverCertificate:
                              type: string
                          type: object
                        mode:
                          enum:
                          - DISABLED
                          - SIMPLE
                          - MUTUAL
                          type: string
                        secretName:
                          type: string
                      type: object
                    xxxOldAuthentication:
                      oneOf:
                      - not:
                          anyOf:
                          - properties:
                              jwt:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - jwksUri
                                    - required:
                                      - jwks
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            required:
                            - jwt
                      - properties:
                          jwt:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            - required:
                              - jwksUri
                            - required:
                              - jwks
                        required:
                        - jwt
                      properties:
                        jwt:
                          properties:
                            audiences:
                              items:
                                type: string
                              type: array
                            issuer:
                              description: Identifies the issuer that issued the JWT.
                              type: string
                            jwks:
                              description: JSON Web Key Set of public keys to validate
                                signature of the JWT.
                              type: string
                            jwksUri:
                              type: string
                          type: object
                      type: object
                    xxxOldAuthorization:
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - external
                          - required:
                            - local
                      - required:
                        - external
                      - required:
                        - local
                      properties:
                        external:
                          properties:
                            includeRequestHeaders:
                              items:
                                type: string
                              type: array
                            uri:
                              type: string
                          type: object
                        local:
                          properties:
                            rules:
                              items:
                                properties:
                                  from:
                                    items:
                                      properties:
                                        jwt:
                                          description: JWT configuration to identity
                                            the subject.
                                          properties:
                                            iss:
                                              type: string
                                            other:
                                              additionalProperties:
                                                type: string
                                              description: A set of arbitrary claims
                                                that are required to qualify the subject.
                                              type: object
                                            sub:
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  name:
                                    description: A friendly name to identify the binding.
                                    type: string
                                  to:
                                    items:
                                      properties:
                                        methods:
                                          description: The HTTP methods that are allowed
                                            by this rule.
                                          items:
                                            type: string
                                          type: array
                                        paths:
                                          description: The request path where the
                                            request is made against.
                                          items:
                                            type: string
                                          type: array
                                      type: object
                                    type: array
                                type: object
                              type: array
                          type: object
                      type: object
                  type: object
                type: array
              tcp:
                items:
                  properties:
                    hostname:
                      description: Hostname to identify the service.
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    route:
                      description: Forward the connection to the specified destination.
                      properties:
                        host:
                          type: string
                        port:
                          description: The port on the service to forward the request
                            to.
                          maximum: 4294967295
                          minimum: 0
                          type: integer
                      type: object
                    tls:
                      properties:
                        files:
                          properties:
                            caCertificates:
                              type: string
                            privateKey:
                              type: string
                            serverCertificate:
                              type: string
                          type: object
                        mode:
                          enum:
                          - DISABLED
                          - SIMPLE
                          - MUTUAL
                          type: string
                        secretName:
                          type: string
                      type: object
                  type: object
                type: array
              tlsPassthrough:
                description: One or more TLS servers exposed by the gateway.
                items:
                  properties:
                    hostname:
                      description: Hostname with which the service can be expected
                        to be accessed by clients.
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    route:
                      description: Forward the connection to the specified destination.
                      properties:
                        host:
                          type: string
                        port:
                          description: The port on the service to forward the request
                            to.
                          maximum: 4294967295
                          minimum: 0
                          type: integer
                      type: object
                  type: object
                type: array
              workloadSelector:
                properties:
                  labels:
                    additionalProperties:
                      type: string
                    type: object
                  namespace:
                    description: The namespace where the workload resides.
                    type: string
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: tier1gateways.gateway.tsb.tetrate.io
spec:
  group: gateway.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - gateway-tsb-tetrate-io
    kind: Tier1Gateway
    listKind: Tier1GatewayList
    plural: tier1gateways
    shortNames:
    - tt1
    singular: tier1gateway
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/gatewayGroup']
      name: Gateway-Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`Tier1Gateway` configures a workload to act as a tier1 gateway
              into the mesh.'
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              externalServers:
                description: One or more servers exposed by the gateway externally.
                items:
                  properties:
                    authentication:
                      oneOf:
                      - not:
                          anyOf:
                          - properties:
                              jwt:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - jwksUri
                                    - required:
                                      - jwks
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            required:
                            - jwt
                      - properties:
                          jwt:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            - required:
                              - jwksUri
                            - required:
                              - jwks
                        required:
                        - jwt
                      properties:
                        jwt:
                          properties:
                            audiences:
                              items:
                                type: string
                              type: array
                            issuer:
                              description: Identifies the issuer that issued the JWT.
                              type: string
                            jwks:
                              description: JSON Web Key Set of public keys to validate
                                signature of the JWT.
                              type: string
                            jwksUri:
                              type: string
                          type: object
                      type: object
                    authorization:
                      description: Authorization is used to configure authorization
                        of end users.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - external
                          - required:
                            - local
                      - required:
                        - external
                      - required:
                        - local
                      properties:
                        external:
                          properties:
                            includeRequestHeaders:
                              items:
                                type: string
                              type: array
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                            uri:
                              type: string
                          type: object
                        local:
                          properties:
                            rules:
                              items:
                                properties:
                                  from:
                                    items:
                                      properties:
                                        jwt:
                                          description: JWT configuration to identity
                                            the subject.
                                          properties:
                                            iss:
                                              type: string
                                            other:
                                              additionalProperties:
                                                type: string
                                              description: A set of arbitrary claims
                                                that are required to qualify the subject.
                                              type: object
                                            sub:
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  name:
                                    description: A friendly name to identify the binding.
                                    type: string
                                  to:
                                    items:
                                      properties:
                                        methods:
                                          description: The HTTP methods that are allowed
                                            by this rule.
                                          items:
                                            type: string
                                          type: array
                                        paths:
                                          description: The request path where the
                                            request is made against.
                                          items:
                                            type: string
                                          type: array
                                      type: object
                                    type: array
                                type: object
                              type: array
                          type: object
                      type: object
                    clusters:
                      items:
                        properties:
                          labels:
                            additionalProperties:
                              type: string
                            description: Labels associated with the cluster.
                            type: object
                          name:
                            description: The name of the destination cluster.
                            type: string
                          network:
                            description: The network associated with the destination
                              clusters.
                            type: string
                          weight:
                            description: The weight for traffic to a given destination.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    hostname:
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    rateLimiting:
                      description: Configuration for rate limiting requests.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - settings
                          - required:
                            - externalService
                      - required:
                        - settings
                      - required:
                        - externalService
                      properties:
                        externalService:
                          description: Configure ratelimiting using an external ratelimit
                            server.
                          properties:
                            domain:
                              description: The rate limit domain to use when calling
                                the rate limit service.
                              type: string
                            failClosed:
                              type: boolean
                            rateLimitServerUri:
                              description: The URI at which the external rate limit
                                server can be reached.
                              type: string
                            rules:
                              description: A set of rate limit rules.
                              items:
                                properties:
                                  dimensions:
                                    description: A list of dimensions that are to
                                      be applied for this rate limit configuration.
                                    items:
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - sourceCluster
                                          - required:
                                            - destinationCluster
                                          - required:
                                            - remoteAddress
                                          - required:
                                            - requestHeaders
                                          - required:
                                            - headerValueMatch
                                      - required:
                                        - sourceCluster
                                      - required:
                                        - destinationCluster
                                      - required:
                                        - remoteAddress
                                      - required:
                                        - requestHeaders
                                      - required:
                                        - headerValueMatch
                                      properties:
                                        destinationCluster:
                                          description: Rate limit on destination envoy
                                            cluster.
                                          type: object
                                        headerValueMatch:
                                          description: Rate limit on the existence
                                            of certain request headers.
                                          properties:
                                            descriptorValue:
                                              description: The value to use in the
                                                descriptor entry.
                                              type: string
                                            headers:
                                              additionalProperties:
                                                oneOf:
                                                - not:
                                                    anyOf:
                                                    - required:
                                                      - exact
                                                    - required:
                                                      - prefix
                                                    - required:
                                                      - regex
                                                - required:
                                                  - exact
                                                - required:
                                                  - prefix
                                                - required:
                                                  - regex
                                                properties:
                                                  exact:
                                                    description: Exact string match.
                                                    type: string
                                                  prefix:
                                                    description: Prefix-based match.
                                                    type: string
                                                  regex:
                                                    description: ECMAscript style
                                                      regex-based match.
                                                    type: string
                                                type: object
                                              type: object
                                          type: object
                                        remoteAddress:
                                          description: Rate limit on remote address
                                            of client.
                                          type: object
                                        requestHeaders:
                                          description: Rate limit on the value of
                                            certain request headers.
                                          properties:
                                            descriptorKey:
                                              description: The key to use in the descriptor
                                                entry.
                                              type: string
                                            headerName:
                                              description: The header name to be queried
                                                from the request headers.
                                              type: string
                                          type: object
                                        sourceCluster:
                                          description: Rate limit on source envoy
                                            cluster.
                                          type: object
                                      type: object
                                    type: array
                                type: object
                              type: array
                            timeout:
                              description: The timeout in seconds for the external
                                rate limit server RPC.
                              type: string
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                          type: object
                        settings:
                          properties:
                            failClosed:
                              type: boolean
                            rules:
                              description: A list of rules for ratelimiting.
                              items:
                                properties:
                                  dimensions:
                                    description: A list of dimensions to define each
                                      ratelimit rule.
                                    items:
                                      oneOf:
                                      - not:
                                          anyOf:
                                          - required:
                                            - remoteAddress
                                          - required:
                                            - header
                                      - required:
                                        - remoteAddress
                                      - required:
                                        - header
                                      properties:
                                        header:
                                          description: Rate limit on certain HTTP
                                            headers.
                                          properties:
                                            name:
                                              description: Name of the header to match
                                                on.
                                              type: string
                                            value:
                                              description: Value of the header to
                                                match on if matching on a specific
                                                value.
                                              oneOf:
                                              - not:
                                                  anyOf:
                                                  - required:
                                                    - exact
                                                  - required:
                                                    - prefix
                                                  - required:
                                                    - regex
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                              properties:
                                                exact:
                                                  description: Exact string match.
                                                  type: string
                                                prefix:
                                                  description: Prefix-based match.
                                                  type: string
                                                regex:
                                                  description: ECMAscript style regex-based
                                                    match.
                                                  type: string
                                              type: object
                                          type: object
                                        remoteAddress:
                                          description: Rate limit on the remote address
                                            of client.
                                          properties:
                                            value:
                                              description: Ratelimit on a specific
                                                remote address.
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  limit:
                                    description: The ratelimit value that will be
                                      configured for the above rules.
                                    properties:
                                      requestsPerUnit:
                                        description: Specifies the value of the rate
                                          limit.
                                        maximum: 4294967295
                                        minimum: 0
                                        type: integer
                                      unit:
                                        description: Specifies the unit of time for
                                          rate limit.
                                        enum:
                                        - UNKNOWN
                                        - SECOND
                                        - MINUTE
                                        - HOUR
                                        - DAY
                                        type: string
                                    type: object
                                type: object
                              type: array
                            timeout:
                              description: The timeout in seconds for the rate limit
                                server RPC.
                              type: string
                          type: object
                      type: object
                    redirect:
                      description: Redirect allows configuring HTTP redirect.
                      properties:
                        authority:
                          description: On a redirect, overwrite the Authority/Host
                            portion of the URL with this value.
                          type: string
                        port:
                          maximum: 4294967295
                          minimum: 0
                          type: integer
                        redirectCode:
                          maximum: 4294967295
                          minimum: 0
                          type: integer
                        scheme:
                          description: On a redirect, overwrite the scheme with this
                            one.
                          type: string
                        uri:
                          description: On a redirect, overwrite the Path portion of
                            the URL with this value.
                          type: string
                      type: object
                    tls:
                      description: TLS certificate info.
                      properties:
                        files:
                          properties:
                            caCertificates:
                              type: string
                            privateKey:
                              type: string
                            serverCertificate:
                              type: string
                          type: object
                        mode:
                          enum:
                          - DISABLED
                          - SIMPLE
                          - MUTUAL
                          type: string
                        secretName:
                          type: string
                      type: object
                  type: object
                type: array
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              internalServers:
                description: One or more servers exposed by the gateway internally
                  for cross cluster forwarding.
                items:
                  properties:
                    authentication:
                      oneOf:
                      - not:
                          anyOf:
                          - properties:
                              jwt:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - jwksUri
                                    - required:
                                      - jwks
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            required:
                            - jwt
                      - properties:
                          jwt:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - jwksUri
                                - required:
                                  - jwks
                            - required:
                              - jwksUri
                            - required:
                              - jwks
                        required:
                        - jwt
                      properties:
                        jwt:
                          properties:
                            audiences:
                              items:
                                type: string
                              type: array
                            issuer:
                              description: Identifies the issuer that issued the JWT.
                              type: string
                            jwks:
                              description: JSON Web Key Set of public keys to validate
                                signature of the JWT.
                              type: string
                            jwksUri:
                              type: string
                          type: object
                      type: object
                    authorization:
                      description: Authorization is used to configure authorization
                        of end user and traffic.
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - external
                          - required:
                            - local
                      - required:
                        - external
                      - required:
                        - local
                      properties:
                        external:
                          properties:
                            includeRequestHeaders:
                              items:
                                type: string
                              type: array
                            tls:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - files
                              - required:
                                - files
                              properties:
                                files:
                                  properties:
                                    caCertificates:
                                      type: string
                                    clientCertificate:
                                      description: Certificate file to authenticate
                                        the client.
                                      type: string
                                    privateKey:
                                      description: Private key file associated with
                                        the client certificate.
                                      type: string
                                  type: object
                                mode:
                                  enum:
                                  - DISABLED
                                  - SIMPLE
                                  - MUTUAL
                                  type: string
                                subjectAltNames:
                                  items:
                                    type: string
                                  type: array
                              type: object
                            uri:
                              type: string
                          type: object
                        local:
                          properties:
                            rules:
                              items:
                                properties:
                                  from:
                                    items:
                                      properties:
                                        jwt:
                                          description: JWT configuration to identity
                                            the subject.
                                          properties:
                                            iss:
                                              type: string
                                            other:
                                              additionalProperties:
                                                type: string
                                              description: A set of arbitrary claims
                                                that are required to qualify the subject.
                                              type: object
                                            sub:
                                              type: string
                                          type: object
                                      type: object
                                    type: array
                                  name:
                                    description: A friendly name to identify the binding.
                                    type: string
                                  to:
                                    items:
                                      properties:
                                        methods:
                                          description: The HTTP methods that are allowed
                                            by this rule.
                                          items:
                                            type: string
                                          type: array
                                        paths:
                                          description: The request path where the
                                            request is made against.
                                          items:
                                            type: string
                                          type: array
                                      type: object
                                    type: array
                                type: object
                              type: array
                          type: object
                      type: object
                    clusters:
                      items:
                        properties:
                          labels:
                            additionalProperties:
                              type: string
                            description: Labels associated with the cluster.
                            type: object
                          name:
                            description: The name of the destination cluster.
                            type: string
                          network:
                            description: The network associated with the destination
                              clusters.
                            type: string
                          weight:
                            description: The weight for traffic to a given destination.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    hostname:
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                  type: object
                type: array
              passthroughServers:
                description: One or more tls passthrough servers exposed by the gateway
                  externally.
                items:
                  properties:
                    clusters:
                      items:
                        properties:
                          labels:
                            additionalProperties:
                              type: string
                            description: Labels associated with the cluster.
                            type: object
                          name:
                            description: The name of the destination cluster.
                            type: string
                          network:
                            description: The network associated with the destination
                              clusters.
                            type: string
                          weight:
                            description: The weight for traffic to a given destination.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    hostname:
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                  type: object
                type: array
              tcpExternalServers:
                description: One or more tcp servers exposed by the gateway externally.
                items:
                  properties:
                    clusters:
                      description: The destination clusters contain ingress gateways
                        exposing the service.
                      items:
                        properties:
                          labels:
                            additionalProperties:
                              type: string
                            description: Labels associated with the cluster.
                            type: object
                          name:
                            description: The name of the destination cluster.
                            type: string
                          network:
                            description: The network associated with the destination
                              clusters.
                            type: string
                          weight:
                            description: The weight for traffic to a given destination.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    hostname:
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                    port:
                      description: The port where the server is exposed.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    tls:
                      description: TLS certificate information to terminate TLS.
                      properties:
                        files:
                          properties:
                            caCertificates:
                              type: string
                            privateKey:
                              type: string
                            serverCertificate:
                              type: string
                          type: object
                        mode:
                          enum:
                          - DISABLED
                          - SIMPLE
                          - MUTUAL
                          type: string
                        secretName:
                          type: string
                      type: object
                  type: object
                type: array
              tcpInternalServers:
                description: One or more tcp servers exposed by the gateway for mesh
                  internal traffic.
                items:
                  properties:
                    clusters:
                      description: The destination clusters contain ingress gateways
                        exposing the service.
                      items:
                        properties:
                          labels:
                            additionalProperties:
                              type: string
                            description: Labels associated with the cluster.
                            type: object
                          name:
                            description: The name of the destination cluster.
                            type: string
                          network:
                            description: The network associated with the destination
                              clusters.
                            type: string
                          weight:
                            description: The weight for traffic to a given destination.
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    hostname:
                      description: The name of the service used.
                      type: string
                    name:
                      description: A name assigned to the server.
                      type: string
                  type: object
                type: array
              workloadSelector:
                properties:
                  labels:
                    additionalProperties:
                      type: string
                    type: object
                  namespace:
                    description: The namespace where the workload resides.
                    type: string
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: groups.istiointernal.tsb.tetrate.io
spec:
  group: istiointernal.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - internalistio-tsb-tetrate-io
    kind: Group
    listKind: GroupList
    plural: groups
    shortNames:
    - tiig
    singular: group
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              namespaceSelector:
                description: Set of namespaces owned exclusively by this group.
                properties:
                  names:
                    items:
                      type: string
                    type: array
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: apinaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: APInAccessBindings
    listKind: APInAccessBindingsList
    plural: apinaccessbindingss
    shortNames:
    - tapib
    singular: apinaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/api']
      name: API
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/application']
      name: Application
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`APInAccessBindings` assigns permissions to users of APIs.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: accessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: AccessBindings
    listKind: AccessBindingsList
    plural: accessbindingss
    shortNames:
    - tab
    singular: accessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/fqn']
      name: FQN
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`AccessBindings` assigns permissions to users of any TSB
              resource.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: applicationaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: ApplicationAccessBindings
    listKind: ApplicationAccessBindingsList
    plural: applicationaccessbindingss
    shortNames:
    - tappb
    singular: applicationaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/application']
      name: Application
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`ApplicationAccessBindings` assigns permissions to users
              of applications.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: gatewayaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: GatewayAccessBindings
    listKind: GatewayAccessBindingsList
    plural: gatewayaccessbindingss
    shortNames:
    - tgb
    singular: gatewayaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/gatewayGroup']
      name: Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`GatewayAccessBindings` assigns permissions to users of
              gateway groups.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: istiointernalaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: IstioInternalAccessBindings
    listKind: IstioInternalAccessBindingsList
    plural: istiointernalaccessbindingss
    shortNames:
    - ttrb
    singular: istiointernalaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/istioInternalGroup']
      name: Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`IstioInternalAccessBindings` assigns permissions to users
              of istio internal groups.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: organizationaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: OrganizationAccessBindings
    listKind: OrganizationAccessBindingsList
    plural: organizationaccessbindingss
    shortNames:
    - tob
    singular: organizationaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`OrganizationAccessBindings` assigns permissions to users
              of organizations.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: roles.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: Role
    listKind: RoleList
    plural: roles
    shortNames:
    - tr
    singular: role
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              rules:
                description: A set of rules that define the permissions associated
                  with each API group.
                items:
                  properties:
                    permissions:
                      description: The set of actions allowed for these APIs.
                      items:
                        enum:
                        - INVALID
                        - READ
                        - WRITE
                        - CREATE
                        - DELETE
                        - SET_POLICY
                        type: string
                      type: array
                    types:
                      description: The set of API groups and the api Kinds within
                        the group on which this rule is applicable.
                      items:
                        properties:
                          apiGroup:
                            description: A specific API group such as traffic.tsb.tetrate.io/v2.
                            type: string
                          kinds:
                            description: Specific kinds of APIs under the API group.
                            items:
                              type: string
                            type: array
                        type: object
                      type: array
                  type: object
                type: array
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: securityaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: SecurityAccessBindings
    listKind: SecurityAccessBindingsList
    plural: securityaccessbindingss
    shortNames:
    - tsb
    singular: securityaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/securityGroup']
      name: Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`SecurityAccessBindings` assigns permissions to users of
              security groups.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: tenantaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: TenantAccessBindings
    listKind: TenantAccessBindingsList
    plural: tenantaccessbindingss
    shortNames:
    - ttb
    singular: tenantaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`TenantAccessBindings` assigns permissions to users of tenants.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: trafficaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: TrafficAccessBindings
    listKind: TrafficAccessBindingsList
    plural: trafficaccessbindingss
    shortNames:
    - ttrb
    singular: trafficaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/trafficGroup']
      name: Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`TrafficAccessBindings` assigns permissions to users of
              traffic groups.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: workspaceaccessbindingss.rbac.tsb.tetrate.io
spec:
  group: rbac.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - rbac-tsb-tetrate-io
    kind: WorkspaceAccessBindings
    listKind: WorkspaceAccessBindingsList
    plural: workspaceaccessbindingss
    shortNames:
    - twb
    singular: workspaceaccessbindings
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: '`WorkspaceAccessBindings` assigns permissions to users of
              workspaces.'
            properties:
              allow:
                items:
                  properties:
                    role:
                      type: string
                    subjects:
                      items:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - user
                            - required:
                              - team
                            - required:
                              - serviceAccount
                        - required:
                          - user
                        - required:
                          - team
                        - required:
                          - serviceAccount
                        properties:
                          serviceAccount:
                            description: A service account in TSB.
                            type: string
                          team:
                            description: A team in TSB, created through LDAP sync
                              or API.
                            type: string
                          user:
                            description: A user in TSB, created through LDAP sync
                              or API.
                            type: string
                        type: object
                      type: array
                  type: object
                type: array
              description:
                description: A description of the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: groups.security.tsb.tetrate.io
spec:
  group: security.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - security-tsb-tetrate-io
    kind: Group
    listKind: GroupList
    plural: groups
    shortNames:
    - tsg
    singular: group
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.configMode
      name: Mode
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              configMode:
                enum:
                - BRIDGED
                - DIRECT
                type: string
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              namespaceSelector:
                description: Set of namespaces owned exclusively by this group.
                properties:
                  names:
                    items:
                      type: string
                    type: array
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: securitysettings.security.tsb.tetrate.io
spec:
  group: security.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - security-tsb-tetrate-io
    kind: SecuritySetting
    listKind: SecuritySettingList
    plural: securitysettings
    shortNames:
    - xss
    singular: securitysetting
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/securityGroup']
      name: Security-Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              authentication:
                enum:
                - UNSET
                - OPTIONAL
                - REQUIRED
                type: string
              authenticationSettings:
                properties:
                  http:
                    oneOf:
                    - not:
                        anyOf:
                        - properties:
                            jwt:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - jwksUri
                                  - required:
                                    - jwks
                              - required:
                                - jwksUri
                              - required:
                                - jwks
                          required:
                          - jwt
                    - properties:
                        jwt:
                          oneOf:
                          - not:
                              anyOf:
                              - required:
                                - jwksUri
                              - required:
                                - jwks
                          - required:
                            - jwksUri
                          - required:
                            - jwks
                      required:
                      - jwt
                    properties:
                      jwt:
                        properties:
                          audiences:
                            items:
                              type: string
                            type: array
                          issuer:
                            description: Identifies the issuer that issued the JWT.
                            type: string
                          jwks:
                            description: JSON Web Key Set of public keys to validate
                              signature of the JWT.
                            type: string
                          jwksUri:
                            type: string
                        type: object
                    type: object
                  trafficMode:
                    enum:
                    - UNSET
                    - OPTIONAL
                    - REQUIRED
                    type: string
                type: object
              authorization:
                properties:
                  http:
                    description: This is for configuring HTTP request authorization.
                    oneOf:
                    - not:
                        anyOf:
                        - required:
                          - external
                        - required:
                          - local
                    - required:
                      - external
                    - required:
                      - local
                    properties:
                      external:
                        properties:
                          includeRequestHeaders:
                            items:
                              type: string
                            type: array
                          tls:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - files
                            - required:
                              - files
                            properties:
                              files:
                                properties:
                                  caCertificates:
                                    type: string
                                  clientCertificate:
                                    description: Certificate file to authenticate
                                      the client.
                                    type: string
                                  privateKey:
                                    description: Private key file associated with
                                      the client certificate.
                                    type: string
                                type: object
                              mode:
                                enum:
                                - DISABLED
                                - SIMPLE
                                - MUTUAL
                                type: string
                              subjectAltNames:
                                items:
                                  type: string
                                type: array
                            type: object
                          uri:
                            type: string
                        type: object
                      local:
                        properties:
                          rules:
                            items:
                              properties:
                                from:
                                  items:
                                    properties:
                                      jwt:
                                        description: JWT configuration to identity
                                          the subject.
                                        properties:
                                          iss:
                                            type: string
                                          other:
                                            additionalProperties:
                                              type: string
                                            description: A set of arbitrary claims
                                              that are required to qualify the subject.
                                            type: object
                                          sub:
                                            type: string
                                        type: object
                                    type: object
                                  type: array
                                name:
                                  description: A friendly name to identify the binding.
                                  type: string
                                to:
                                  items:
                                    properties:
                                      methods:
                                        description: The HTTP methods that are allowed
                                          by this rule.
                                        items:
                                          type: string
                                        type: array
                                      paths:
                                        description: The request path where the request
                                          is made against.
                                        items:
                                          type: string
                                        type: array
                                    type: object
                                  type: array
                              type: object
                            type: array
                        type: object
                    type: object
                  mode:
                    description: A short cut for specifying the set of allowed callers.
                    enum:
                    - UNSET
                    - NAMESPACE
                    - GROUP
                    - WORKSPACE
                    - CLUSTER
                    - DISABLED
                    - CUSTOM
                    - RULES
                    type: string
                  rules:
                    properties:
                      allow:
                        description: Allow specifies a list of rules.
                        items:
                          properties:
                            from:
                              description: From specifies the source of a request.
                              properties:
                                fqn:
                                  description: The target resource identified by FQN
                                    which will be the source of a request.
                                  type: string
                              type: object
                            to:
                              description: To specifies the destination of a request.
                              properties:
                                fqn:
                                  description: The target resource identified by FQN
                                    which will be the destination of a request.
                                  type: string
                              type: object
                          type: object
                        type: array
                      deny:
                        description: Deny specifies a list of rules.
                        items:
                          properties:
                            from:
                              description: From specifies the source of a request.
                              properties:
                                fqn:
                                  description: The target resource identified by FQN
                                    which will be the source of a request.
                                  type: string
                              type: object
                            to:
                              description: To specifies the destination of a request.
                              properties:
                                fqn:
                                  description: The target resource identified by FQN
                                    which will be the destination of a request.
                                  type: string
                              type: object
                          type: object
                        type: array
                      denyAll:
                        description: Deny all specifies whether all requests should
                          be rejected.
                        type: boolean
                    type: object
                  serviceAccounts:
                    items:
                      type: string
                    type: array
                type: object
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              propagationStrategy:
                enum:
                - REPLACE
                - STRICTER
                type: string
              wafSettings:
                description: 'NOTICE: this feature is in alpha stage and under active
                  development.'
                properties:
                  ruleEngineMode:
                    description: Ad-hoc settings to switch ModSecurity engine mode.
                    enum:
                    - "OFF"
                    - "ON"
                    - DETECTION_ONLY
                    type: string
                  ruleSets:
                    description: Rulesets to enable.
                    items:
                      type: string
                    type: array
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: groups.traffic.tsb.tetrate.io
spec:
  group: traffic.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - traffic-tsb-tetrate-io
    kind: Group
    listKind: GroupList
    plural: groups
    shortNames:
    - ttg
    singular: group
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.configMode
      name: Mode
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              configMode:
                enum:
                - BRIDGED
                - DIRECT
                type: string
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              namespaceSelector:
                description: Set of namespaces owned exclusively by this group.
                properties:
                  names:
                    items:
                      type: string
                    type: array
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: serviceroutes.traffic.tsb.tetrate.io
spec:
  group: traffic.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - traffic-tsb-tetrate-io
    kind: ServiceRoute
    listKind: ServiceRouteList
    plural: serviceroutes
    shortNames:
    - tsr
    singular: serviceroute
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.service
      name: Service
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/trafficGroup']
      name: Traffic-Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              httpRoutes:
                items:
                  properties:
                    destination:
                      items:
                        properties:
                          destinationHost:
                            description: Service host where traffic should be routed
                              to.
                            type: string
                          port:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          subset:
                            type: string
                          weight:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    match:
                      items:
                        properties:
                          headers:
                            additionalProperties:
                              oneOf:
                              - not:
                                  anyOf:
                                  - required:
                                    - exact
                                  - required:
                                    - prefix
                                  - required:
                                    - regex
                              - required:
                                - exact
                              - required:
                                - prefix
                              - required:
                                - regex
                              properties:
                                exact:
                                  description: Exact string match.
                                  type: string
                                prefix:
                                  description: Prefix-based match.
                                  type: string
                                regex:
                                  description: ECMAscript style regex-based match.
                                  type: string
                              type: object
                            type: object
                          name:
                            type: string
                          port:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          uri:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - exact
                                - required:
                                  - prefix
                                - required:
                                  - regex
                            - required:
                              - exact
                            - required:
                              - prefix
                            - required:
                              - regex
                            properties:
                              exact:
                                description: Exact string match.
                                type: string
                              prefix:
                                description: Prefix-based match.
                                type: string
                              regex:
                                description: ECMAscript style regex-based match.
                                type: string
                            type: object
                        type: object
                      type: array
                    name:
                      type: string
                  type: object
                type: array
              portLevelSettings:
                description: In order to support multi-protocol routing, a list of
                  all port/protocol combinations is needed.
                items:
                  properties:
                    port:
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                    stickySession:
                      oneOf:
                      - not:
                          anyOf:
                          - required:
                            - header
                          - required:
                            - cookie
                          - required:
                            - useSourceIp
                      - required:
                        - header
                      - required:
                        - cookie
                      - required:
                        - useSourceIp
                      properties:
                        cookie:
                          description: Hash based on HTTP cookie.
                          properties:
                            name:
                              description: Name of the cookie.
                              type: string
                            path:
                              description: Path to set for the cookie.
                              type: string
                            ttl:
                              description: Lifetime of the cookie.
                              type: string
                          type: object
                        header:
                          description: Hash based on a specific HTTP header.
                          type: string
                        useSourceIp:
                          description: Hash based on the source IP address.
                          type: boolean
                      type: object
                    trafficType:
                      enum:
                      - HTTP
                      - TCP
                      - TLS_PASSTHROUGH
                      type: string
                  type: object
                type: array
              service:
                description: The service on which the configuration is being applied.
                type: string
              stickySession:
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - header
                    - required:
                      - cookie
                    - required:
                      - useSourceIp
                - required:
                  - header
                - required:
                  - cookie
                - required:
                  - useSourceIp
                properties:
                  cookie:
                    description: Hash based on HTTP cookie.
                    properties:
                      name:
                        description: Name of the cookie.
                        type: string
                      path:
                        description: Path to set for the cookie.
                        type: string
                      ttl:
                        description: Lifetime of the cookie.
                        type: string
                    type: object
                  header:
                    description: Hash based on a specific HTTP header.
                    type: string
                  useSourceIp:
                    description: Hash based on the source IP address.
                    type: boolean
                type: object
              subsets:
                items:
                  properties:
                    labels:
                      additionalProperties:
                        type: string
                      description: Labels apply a filter over the endpoints of a service
                        in the service registry.
                      type: object
                    name:
                      description: Name used to refer to the subset.
                      type: string
                    portLevelSettings:
                      items:
                        properties:
                          port:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          stickySession:
                            oneOf:
                            - not:
                                anyOf:
                                - required:
                                  - header
                                - required:
                                  - cookie
                                - required:
                                  - useSourceIp
                            - required:
                              - header
                            - required:
                              - cookie
                            - required:
                              - useSourceIp
                            properties:
                              cookie:
                                description: Hash based on HTTP cookie.
                                properties:
                                  name:
                                    description: Name of the cookie.
                                    type: string
                                  path:
                                    description: Path to set for the cookie.
                                    type: string
                                  ttl:
                                    description: Lifetime of the cookie.
                                    type: string
                                type: object
                              header:
                                description: Hash based on a specific HTTP header.
                                type: string
                              useSourceIp:
                                description: Hash based on the source IP address.
                                type: boolean
                            type: object
                          trafficType:
                            enum:
                            - HTTP
                            - TCP
                            - TLS_PASSTHROUGH
                            type: string
                        type: object
                      type: array
                    weight:
                      description: Percentage of traffic to be sent to this subset.
                      maximum: 4294967295
                      minimum: 0
                      type: integer
                  type: object
                type: array
              tcpRoutes:
                description: TCPRoutes match TCP traffic based on port number.
                items:
                  properties:
                    destination:
                      items:
                        properties:
                          destinationHost:
                            description: Service host where traffic should be routed
                              to.
                            type: string
                          port:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                          subset:
                            type: string
                          weight:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    match:
                      items:
                        properties:
                          name:
                            type: string
                          port:
                            maximum: 4294967295
                            minimum: 0
                            type: integer
                        type: object
                      type: array
                    name:
                      type: string
                  type: object
                type: array
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: trafficsettings.traffic.tsb.tetrate.io
spec:
  group: traffic.tsb.tetrate.io
  names:
    categories:
    - tetrate-io
    - tsb-tetrate-io
    - traffic-tsb-tetrate-io
    kind: TrafficSetting
    listKind: TrafficSettingList
    plural: trafficsettings
    shortNames:
    - tts
    singular: trafficsetting
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/trafficGroup']
      name: Traffic-Group
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/workspace']
      name: Workspace
      type: string
    - jsonPath: .metadata.annotations['tsb\.tetrate\.io\/tenant']
      name: Tenant
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              description:
                description: A description of the resource.
                type: string
              displayName:
                description: User friendly name for the resource.
                type: string
              egress:
                properties:
                  host:
                    description: Specifies the egress gateway hostname.
                    type: string
                  port:
                    description: Deprecated.
                    format: int32
                    type: integer
                type: object
              etag:
                description: The etag for the resource.
                type: string
              fqn:
                description: Fully-qualified name of the resource.
                type: string
              rateLimiting:
                description: Configuration for rate limiting requests.
                oneOf:
                - not:
                    anyOf:
                    - required:
                      - settings
                    - required:
                      - externalService
                - required:
                  - settings
                - required:
                  - externalService
                properties:
                  externalService:
                    description: Configure ratelimiting using an external ratelimit
                      server.
                    properties:
                      domain:
                        description: The rate limit domain to use when calling the
                          rate limit service.
                        type: string
                      failClosed:
                        type: boolean
                      rateLimitServerUri:
                        description: The URI at which the external rate limit server
                          can be reached.
                        type: string
                      rules:
                        description: A set of rate limit rules.
                        items:
                          properties:
                            dimensions:
                              description: A list of dimensions that are to be applied
                                for this rate limit configuration.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - sourceCluster
                                    - required:
                                      - destinationCluster
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - requestHeaders
                                    - required:
                                      - headerValueMatch
                                - required:
                                  - sourceCluster
                                - required:
                                  - destinationCluster
                                - required:
                                  - remoteAddress
                                - required:
                                  - requestHeaders
                                - required:
                                  - headerValueMatch
                                properties:
                                  destinationCluster:
                                    description: Rate limit on destination envoy cluster.
                                    type: object
                                  headerValueMatch:
                                    description: Rate limit on the existence of certain
                                      request headers.
                                    properties:
                                      descriptorValue:
                                        description: The value to use in the descriptor
                                          entry.
                                        type: string
                                      headers:
                                        additionalProperties:
                                          oneOf:
                                          - not:
                                              anyOf:
                                              - required:
                                                - exact
                                              - required:
                                                - prefix
                                              - required:
                                                - regex
                                          - required:
                                            - exact
                                          - required:
                                            - prefix
                                          - required:
                                            - regex
                                          properties:
                                            exact:
                                              description: Exact string match.
                                              type: string
                                            prefix:
                                              description: Prefix-based match.
                                              type: string
                                            regex:
                                              description: ECMAscript style regex-based
                                                match.
                                              type: string
                                          type: object
                                        type: object
                                    type: object
                                  remoteAddress:
                                    description: Rate limit on remote address of client.
                                    type: object
                                  requestHeaders:
                                    description: Rate limit on the value of certain
                                      request headers.
                                    properties:
                                      descriptorKey:
                                        description: The key to use in the descriptor
                                          entry.
                                        type: string
                                      headerName:
                                        description: The header name to be queried
                                          from the request headers.
                                        type: string
                                    type: object
                                  sourceCluster:
                                    description: Rate limit on source envoy cluster.
                                    type: object
                                type: object
                              type: array
                          type: object
                        type: array
                      timeout:
                        description: The timeout in seconds for the external rate
                          limit server RPC.
                        type: string
                      tls:
                        oneOf:
                        - not:
                            anyOf:
                            - required:
                              - files
                        - required:
                          - files
                        properties:
                          files:
                            properties:
                              caCertificates:
                                type: string
                              clientCertificate:
                                description: Certificate file to authenticate the
                                  client.
                                type: string
                              privateKey:
                                description: Private key file associated with the
                                  client certificate.
                                type: string
                            type: object
                          mode:
                            enum:
                            - DISABLED
                            - SIMPLE
                            - MUTUAL
                            type: string
                          subjectAltNames:
                            items:
                              type: string
                            type: array
                        type: object
                    type: object
                  settings:
                    properties:
                      failClosed:
                        type: boolean
                      rules:
                        description: A list of rules for ratelimiting.
                        items:
                          properties:
                            dimensions:
                              description: A list of dimensions to define each ratelimit
                                rule.
                              items:
                                oneOf:
                                - not:
                                    anyOf:
                                    - required:
                                      - remoteAddress
                                    - required:
                                      - header
                                - required:
                                  - remoteAddress
                                - required:
                                  - header
                                properties:
                                  header:
                                    description: Rate limit on certain HTTP headers.
                                    properties:
                                      name:
                                        description: Name of the header to match on.
                                        type: string
                                      value:
                                        description: Value of the header to match
                                          on if matching on a specific value.
                                        oneOf:
                                        - not:
                                            anyOf:
                                            - required:
                                              - exact
                                            - required:
                                              - prefix
                                            - required:
                                              - regex
                                        - required:
                                          - exact
                                        - required:
                                          - prefix
                                        - required:
                                          - regex
                                        properties:
                                          exact:
                                            description: Exact string match.
                                            type: string
                                          prefix:
                                            description: Prefix-based match.
                                            type: string
                                          regex:
                                            description: ECMAscript style regex-based
                                              match.
                                            type: string
                                        type: object
                                    type: object
                                  remoteAddress:
                                    description: Rate limit on the remote address
                                      of client.
                                    properties:
                                      value:
                                        description: Ratelimit on a specific remote
                                          address.
                                        type: string
                                    type: object
                                type: object
                              type: array
                            limit:
                              description: The ratelimit value that will be configured
                                for the above rules.
                              properties:
                                requestsPerUnit:
                                  description: Specifies the value of the rate limit.
                                  maximum: 4294967295
                                  minimum: 0
                                  type: integer
                                unit:
                                  description: Specifies the unit of time for rate
                                    limit.
                                  enum:
                                  - UNKNOWN
                                  - SECOND
                                  - MINUTE
                                  - HOUR
                                  - DAY
                                  type: string
                              type: object
                          type: object
                        type: array
                      timeout:
                        description: The timeout in seconds for the rate limit server
                          RPC.
                        type: string
                    type: object
                type: object
              reachability:
                properties:
                  hosts:
                    items:
                      type: string
                    type: array
                  mode:
                    description: A short cut for specifying the set of services accessed
                      by the workload.
                    enum:
                    - UNSET
                    - NAMESPACE
                    - GROUP
                    - WORKSPACE
                    - CLUSTER
                    - CUSTOM
                    type: string
                type: object
              resilience:
                properties:
                  circuitBreakerSensitivity:
                    enum:
                    - UNSET
                    - LOW
                    - MEDIUM
                    - HIGH
                    type: string
                  httpRequestTimeout:
                    description: Timeout for HTTP requests.
                    type: string
                  httpRetries:
                    description: Retry policy for HTTP requests.
                    properties:
                      attempts:
                        description: Number of retries for a given request.
                        format: int32
                        type: integer
                      perTryTimeout:
                        description: Timeout per retry attempt for a given request.
                        type: string
                      retryOn:
                        description: Specifies the conditions under which retry takes
                          place.
                        type: string
                    type: object
                  keepAlive:
                    description: Keep Alive Settings.
                    properties:
                      tcp:
                        description: TCP Keep Alive settings associated with the upstream
                          and downstream TCP connections.
                        properties:
                          downstream:
                            description: TCP Keep Alive Settings associated with the
                              downstream (client) connection.
                            properties:
                              idleTime:
                                maximum: 4294967295
                                minimum: 0
                                nullable: true
                                type: integer
                              interval:
                                description: The number of seconds between keep-alive
                                  probes.
                                maximum: 4294967295
                                minimum: 0
                                nullable: true
                                type: integer
                              probes:
                                maximum: 4294967295
                                minimum: 0
                                nullable: true
                                type: integer
                            type: object
                          upstream:
                            description: TCP Keep Alive Settings associated with the
                              upstream (backend) connection.
                            properties:
                              idleTime:
                                maximum: 4294967295
                                minimum: 0
                                nullable: true
                                type: integer
                              interval:
                                description: The number of seconds between keep-alive
                                  probes.
                                maximum: 4294967295
                                minimum: 0
                                nullable: true
                                type: integer
                              probes:
                                maximum: 4294967295
                                minimum: 0
                                nullable: true
                                type: integer
                            type: object
                        type: object
                    type: object
                  tcpKeepalive:
                    description: Deprecated.
                    nullable: true
                    type: boolean
                type: object
            type: object
          status:
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}

---
