2 top-level fields · last changed in Istio 1.20.0
Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html
Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh.
The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to.
When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not).
One or more service hosts exposed by the listener in `namespace/dnsName` format.
The port associated with the listener.
Label assigned to the port.
A valid non-negative integer port number.
The protocol exposed on the port.
Settings controlling the volume of connections Envoy will accept from the network.
HTTP connection pool settings.
Specify if http1.1 connection should be upgraded to http2 for the associated destination.
Maximum number of requests that will be queued while waiting for a ready connection pool connection.
Maximum number of active requests to a destination.
The idle timeout for upstream connection pool connections.
Maximum number of requests per connection to a backend.
Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
If set to true, client protocol will be preserved while initiating connection to backend.
Settings common to both HTTP and TCP upstream connections.
TCP connection timeout.
The maximum duration of a connection.
Maximum number of HTTP1 /TCP connections to a destination host.
If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
The time duration between keep-alive probes.
Maximum number of keepalive probes to send without response before deciding the connection is dead.
The time duration a connection needs to be idle before keep-alive probes start being sent.
Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance.
The IP(IPv4 or IPv6) to which the listener should be bound.
The captureMode option dictates how traffic to the listener is expected to be captured (or not).
Settings controlling the volume of connections Envoy will accept from the network.
HTTP connection pool settings.
Specify if http1.1 connection should be upgraded to http2 for the associated destination.
Maximum number of requests that will be queued while waiting for a ready connection pool connection.
Maximum number of active requests to a destination.
The idle timeout for upstream connection pool connections.
Maximum number of requests per connection to a backend.
Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
If set to true, client protocol will be preserved while initiating connection to backend.
Settings common to both HTTP and TCP upstream connections.
TCP connection timeout.
The maximum duration of a connection.
Maximum number of HTTP1 /TCP connections to a destination host.
If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
The time duration between keep-alive probes.
Maximum number of keepalive probes to send without response before deciding the connection is dead.
The time duration a connection needs to be idle before keep-alive probes start being sent.
The IP endpoint or Unix domain socket to which traffic should be forwarded to.
The port associated with the listener.
Label assigned to the port.
A valid non-negative integer port number.
The protocol exposed on the port.
Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh.
REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.
Optional: If specified, only support the specified cipher list.
For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.
If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
Optional: Maximum TLS protocol version.
Optional: Minimum TLS protocol version.
Optional: Indicates whether connections to this port should be secured using TLS.
REQUIRED if mode is `SIMPLE` or `MUTUAL`.
REQUIRED if mode is `SIMPLE` or `MUTUAL`.
A list of alternate names to verify the subject identity in the certificate presented by the client.
An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.
An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.
Configuration for the outbound traffic policy.
The name of a service from the service registry.
Specifies the port on the host that is being addressed.
The name of a subset within the service.
Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied.
One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
Source: crd-all.gen.yaml
Changes to Sidecar (networking.istio.io/v1alpha3) in each Istio version, compared to the version before it.
2 properties have been added
3 properties are now required
16 properties have changed the description
Released · View Sidecar in 1.20.0
1 property has changed the description
Released · View Sidecar in 1.19.0
1 property has changed the description
Released · View Sidecar in 1.15.0
1 property has been added
Released · View Sidecar in 1.13.0
Sidecar was first seen on this version of Istio
Released · View Sidecar in 1.6.0
No examples of Sidecar yet. Contribute one on GitHub.
kubespec.dev