2 top-level fields · last changed in Istio 1.25.0
Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html
Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh.
The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to.
When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). Valid Options: DEFAULT, IPTABLES, NONE
One or more service hosts exposed by the listener in `namespace/dnsName` format.
The port associated with the listener.
Label assigned to the port.
A valid non-negative integer port number.
The protocol exposed on the port.
Settings controlling the volume of connections Envoy will accept from the network.
HTTP connection pool settings.
Specify if http1.1 connection should be upgraded to http2 for the associated destination. Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
Maximum number of requests that will be queued while waiting for a ready connection pool connection.
Maximum number of active requests to a destination.
The idle timeout for upstream connection pool connections.
The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
Maximum number of requests per connection to a backend.
Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
If set to true, client protocol will be preserved while initiating connection to backend.
Settings common to both HTTP and TCP upstream connections.
TCP connection timeout.
The idle timeout for TCP connections.
The maximum duration of a connection.
Maximum number of HTTP1 /TCP connections to a destination host.
If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
The time duration between keep-alive probes.
Maximum number of keepalive probes to send without response before deciding the connection is dead.
The time duration a connection needs to be idle before keep-alive probes start being sent.
Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance.
The IP(IPv4 or IPv6) to which the listener should be bound.
The captureMode option dictates how traffic to the listener is expected to be captured (or not). Valid Options: DEFAULT, IPTABLES, NONE
Settings controlling the volume of connections Envoy will accept from the network.
HTTP connection pool settings.
Specify if http1.1 connection should be upgraded to http2 for the associated destination. Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
Maximum number of requests that will be queued while waiting for a ready connection pool connection.
Maximum number of active requests to a destination.
The idle timeout for upstream connection pool connections.
The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
Maximum number of requests per connection to a backend.
Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.
If set to true, client protocol will be preserved while initiating connection to backend.
Settings common to both HTTP and TCP upstream connections.
TCP connection timeout.
The idle timeout for TCP connections.
The maximum duration of a connection.
Maximum number of HTTP1 /TCP connections to a destination host.
If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
The time duration between keep-alive probes.
Maximum number of keepalive probes to send without response before deciding the connection is dead.
The time duration a connection needs to be idle before keep-alive probes start being sent.
The IP endpoint or Unix domain socket to which traffic should be forwarded to.
The port associated with the listener.
Label assigned to the port.
A valid non-negative integer port number.
The protocol exposed on the port.
Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh.
REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.
OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.
Optional: If specified, only support the specified cipher list.
For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.
If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.
Optional: Maximum TLS protocol version. Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
Optional: Minimum TLS protocol version. Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3
Optional: Indicates whether connections to this port should be secured using TLS. Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL
REQUIRED if mode is `SIMPLE` or `MUTUAL`.
REQUIRED if mode is `SIMPLE` or `MUTUAL`.
A list of alternate names to verify the subject identity in the certificate presented by the client.
An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.
An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.
Set the default behavior of the sidecar for handling outbound traffic from the application.
The name of a service from the service registry.
Specifies the port on the host that is being addressed.
The name of a subset within the service.
Valid Options: REGISTRY_ONLY, ALLOW_ANY
Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied.
One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
Current service state of the resource.
Last time we probed the condition.
Last time the condition transitioned from one status to another.
Human-readable message indicating details about last transition.
Resource Generation to which the Condition refers.
Unique, one-word, CamelCase reason for the condition's last transition.
Status is the status of the condition.
Type is the type of the condition.
Includes any errors or warnings detected by Istio's analyzers.
A url pointing to the Istio documentation for this specific error type.
Represents how severe a message is. Valid Options: UNKNOWN, ERROR, WARNING, INFO
A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
A human-readable name for the message type.
Source: crd-all.gen.yaml
Changes to Sidecar (networking.istio.io/v1) in each Istio version, compared to the version before it.
Sidecar was first seen on this version of Istio
Released · View Sidecar in 1.22.0
No examples of Sidecar yet. Contribute one on GitHub.
kubespec.dev