// Copyright 2017 Istio Authors
//
//   Licensed under the Apache License, Version 2.0 (the "License");
//   you may not use this file except in compliance with the License.
//   You may obtain a copy of the License at
//
//       http://www.apache.org/licenses/LICENSE-2.0
//
//   Unless required by applicable law or agreed to in writing, software
//   distributed under the License is distributed on an "AS IS" BASIS,
//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//   See the License for the specific language governing permissions and
//   limitations under the License.

syntax = "proto3";

import "routing/v1alpha1/route_rule.proto";

package istio.routing.v1alpha1;

option go_package = "istio.io/api/routing/v1alpha1";

// Ingress rules are routing rules applied to the ingress proxy pool. The
// ingress proxes serve as the receiving edge proxy for the entire mesh, but
// can also be addressed from inside the mesh.  Each ingress rule defines a
// destination service and port. Rules that do not resolve to a service or a
// port in the mesh should be ignored.
//
// The routing rules for the destination service are applied at the ingress
// proxy. That means the routing rule match conditions are composed and its
// actions are enforced. The traffic splitting for the destination service is
// also effective.
//
// WARNING: This API is experimental and under active development
message IngressRule {
  // REQUIRED: Port on which the ingress proxy listens and applies the rule.
  int32 port = 1;

  // Optional TLS secret path to apply server-side TLS context on the port.
  // It is up to the underlying secret store to interpret the path to the secret.
  string tls_secret = 2;

  // RECOMMENDED. Precedence is used to disambiguate the order of application
  // of rules. A higher number takes priority. If not specified, the value is
  // assumed to be 0.  The order of application for rules with the same
  // precedence is unspecified.
  int32 precedence = 3;

  // Match conditions to be satisfied for the ingress rule to be
  // activated.
  MatchCondition match = 4;

  // REQUIRED: Destination uniquely identifies the destination service.
  //
  // *Note:* The ingress rule destination specification represents all version
  // of the service and therefore the IstioService's labels field MUST be empty.
  //
  IstioService destination = 5;

  // REQUIRED: Destination port identifies a port on the destination service for routing.
  oneof destination_service_port {
    // Identifies the destination service port by value
    int32 destination_port = 6;

    // Identifies the destination service port by name
    string destination_port_name = 7;
  }
}

