// Copyright 2017 Istio Authors
//
//   Licensed under the Apache License, Version 2.0 (the "License");
//   you may not use this file except in compliance with the License.
//   You may obtain a copy of the License at
//
//       http://www.apache.org/licenses/LICENSE-2.0
//
//   Unless required by applicable law or agreed to in writing, software
//   distributed under the License is distributed on an "AS IS" BASIS,
//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//   See the License for the specific language governing permissions and
//   limitations under the License.

syntax = "proto3";

import "google/protobuf/duration.proto";

// $title: Service Mesh
// $overview: Configuration affecting the service mesh as a whole
// $location: https://istio.io/docs/reference/config/istio.mesh.v1alpha1.html
// $front_matter: redirect_from: /docs/reference/config/service-mesh.html

package istio.mesh.v1alpha1;

option go_package="istio.io/api/mesh/v1alpha1";

// AuthenticationPolicy defines authentication policy. It can be set for
// different scopes (mesh, service …), and the most narrow scope with
// non-INHERIT value will be used.
// Mesh policy cannot be INHERIT.
enum AuthenticationPolicy {
  // Do not encrypt Envoy to Envoy traffic.
  NONE = 0;

  // Envoy to Envoy traffic is wrapped into mutual TLS connections.
  MUTUAL_TLS = 1;

  // Use the policy defined by the parent scope. Should not be used for mesh
  // policy.
  INHERIT = 1000;
}

// ProxyConfig defines variables for individual Envoy instances.
message ProxyConfig {
  // Path to the generated configuration file directory.
  // Proxy agent generates the actual configuration and stores it in this directory.
  string config_path = 1;

  // Path to the proxy binary
  string binary_path = 2;

  // Service cluster defines the name for the service_cluster that is
  // shared by all Envoy instances. This setting corresponds to
  // _--service-cluster_ flag in Envoy.  In a typical Envoy deployment, the
  // _service-cluster_ flag is used to identify the caller, for
  // source-based routing scenarios.
  //
  // Since Istio does not assign a local service/service version to each
  // Envoy instance, the name is same for all of them.  However, the
  // source/caller's identity (e.g., IP address) is encoded in the
  // _--service-node_ flag when launching Envoy.  When the RDS service
  // receives API calls from Envoy, it uses the value of the _service-node_
  // flag to compute routes that are relative to the service instances
  // located at that IP address.
  string service_cluster = 3;

  // The time in seconds that Envoy will drain connections during a hot
  // restart. MUST be >=1s (e.g., _1s/1m/1h_)
  google.protobuf.Duration drain_duration = 4;

  // The time in seconds that Envoy will wait before shutting down the
  // parent process during a hot restart. MUST be >=1s (e.g., _1s/1m/1h_).
  // MUST BE greater than _drain_duration_ parameter.
  google.protobuf.Duration parent_shutdown_duration = 5;

  // Address of the discovery service exposing xDS with mTLS connection.
  string discovery_address = 6;

  // Polling interval for service discovery (used by EDS, CDS, LDS, but not RDS). (MUST BE >=1ms)
  google.protobuf.Duration discovery_refresh_delay = 7;

  // Address of the Zipkin service (e.g. _zipkin:9411_).
  string zipkin_address = 8;

  // Connection timeout used by Envoy for supporting services. (MUST BE >=1ms)
  google.protobuf.Duration connect_timeout = 9;

  // IP Address and Port of a statsd UDP listener (e.g. _10.75.241.127:9125_).
  string statsd_udp_address = 10;

  // Port on which Envoy should listen for administrative commands.
  int32 proxy_admin_port = 11;
  // The availability zone where this Envoy instance is running. When running
  // Envoy as a sidecar in Kubernetes, this flag must be one of the availability
  // zones assigned to a node using failure-domain.beta.kubernetes.io/zone annotation.
  string availability_zone = 12;

  // Authentication policy defines the global switch to control authentication
  // for Envoy-to-Envoy communication for istio components Mixer and Pilot.
  AuthenticationPolicy control_plane_auth_policy = 13;
  // File path of custom proxy configuration, currently used by proxies
  // in front of Mixer and Pilot.
  string custom_config_file = 14;

  // Maximum length of name field in Envoy's metrics. The length of the name field
  // is determined by the length of a name field in a service and the set of labels that
  // comprise a particular version of the service. The default value is set to 189 characters.
  // Envoy's internal metrics take up 67 characters, for a total of 256 character name per metric.
  // Increase the value of this field if you find that the metrics from Envoys are truncated.
  int32 stat_name_length = 15;

  // The number of worker threads to run. Default value is number of cores on the machine.
  int32 concurrency = 16;

  // Path to the proxy bootstrap template file
  string proxy_bootstrap_template_path = 17;

  // The mode used to redirect inbound traffic to Envoy.
  // This setting has no effect on outbound traffic: iptables REDIRECT is always used for
  // outbound connections.
  enum InboundInterceptionMode {
    // The REDIRECT mode uses iptables REDIRECT to NAT and redirect to Envoy. This mode loses
    // source IP addresses during redirection.
    REDIRECT = 0;
    // The TPROXY mode uses iptables TPROXY to redirect to Envoy. This mode preserves both the
    // source and destination IP addresses and ports, so that they can be used for advanced
    // filtering and manipulation. This mode also configures the sidecar to run with the
    // CAP_NET_ADMIN capability, which is required to use TPROXY.
    TPROXY = 1;
  }

  // The mode used to redirect inbound traffic to Envoy.
  InboundInterceptionMode interception_mode = 18;
}

// MeshConfig defines mesh-wide variables shared by all Envoy instances in the
// Istio service mesh.
//
// NOTE: This configuration type should be used for the low-level global
// configuration, such as component addresses and port numbers. It should not
// be used for the features of the mesh that can be scoped by service or by
// namespace. Some of the fields in the mesh config are going to be deprecated
// and replaced with several individual configuration types (for example,
// tracing configuration).
message MeshConfig {
  // Address of the server that will be used by the proxies for policy
  // check calls. By using different names for mixerCheckServer and
  // mixerReportServer, it is possible to have one set of mixer servers handle
  // policy check calls while another set of mixer servers handle telemetry
  // calls.
  //
  // NOTE: Omitting mixerCheckServer while specifying mixerReportServer is
  // equivalent to setting disablePolicyChecks to true.
  string mixer_check_server = 1;

  // Address of the server that will be used by the proxies for policy report
  // calls.
  string mixer_report_server = 2;

  // Disable policy checks by the mixer service. Default
  // is false, i.e. mixer policy check is enabled by default.
  bool disable_policy_checks = 3;

  // Port on which Envoy should listen for incoming connections from
  // other services.
  int32 proxy_listen_port = 4;

  // Port on which Envoy should listen for HTTP PROXY requests if set.
  int32 proxy_http_port = 5;

  // Connection timeout used by Envoy. (MUST BE >=1ms)
  google.protobuf.Duration connect_timeout = 6;

  // Class of ingress resources to be processed by Istio ingress
  // controller.  This corresponds to the value of
  // "kubernetes.io/ingress.class" annotation.
  string ingress_class = 7;

  // Name of the kubernetes service used for the istio ingress controller.
  string ingress_service = 8;

  enum IngressControllerMode {
    // Disables Istio ingress controller.
    OFF = 0;

    // Istio ingress controller will act on ingress resources that do not
    // contain any annotation or whose annotations match the value
    // specified in the ingress_class parameter described earlier. Use this
    // mode if Istio ingress controller will be the default ingress
    // controller for the entire kubernetes cluster.
    DEFAULT = 1;

    // Istio ingress controller will only act on ingress resources whose
    // annotations match the value specified in the ingress_class parameter
    // described earlier. Use this mode if Istio ingress controller will be
    // a secondary ingress controller (e.g., in addition to a
    // cloud-provided ingress controller).
    STRICT = 2;
  }

  // Defines whether to use Istio ingress controller for annotated or all ingress resources.
  IngressControllerMode ingress_controller_mode = 9;

  // TODO AuthPolicy needs to be removed and merged with AuthPolicy defined above
  enum AuthPolicy {
    // Do not encrypt Envoy to Envoy traffic.
    NONE = 0;

    // Envoy to Envoy traffic is wrapped into mutual TLS connections.
    MUTUAL_TLS = 1;
  }

  // Authentication policy defines the global switch to control authentication
  // for Envoy-to-Envoy communication.
  // Use authentication_policy instead.
  AuthPolicy auth_policy = 10 [deprecated=true];

  // Polling interval for RDS (MUST BE >=1ms)
  google.protobuf.Duration rds_refresh_delay = 11;

  // Flag to control generation of trace spans and request IDs.
  // Requires a trace span collector defined in the proxy configuration.
  bool enable_tracing = 12;

  // File address for the proxy access log (e.g. /dev/stdout).
  // Empty value disables access logging.
  string access_log_file = 13;

  // Default proxy config used by the proxy injection mechanism operating in the mesh
  // (e.g. Kubernetes admission controller)
  // In case of Kubernetes, the proxy config is applied once during the injection process,
  // and remain constant for the duration of the pod. The rest of the mesh config can be changed
  // at runtime and config gets distributed dynamically.
  ProxyConfig default_config = 14;

  // List of remote services for which mTLS authentication should not be expected by Istio .
  // Typically, these are control services (e.g kubernetes API server) that don't have Istio sidecar
  // to transparently terminate mTLS authentication.
  // It has no effect if the authentication policy is already 'NONE'.
  // DO NOT use this setting for services that are managed by Istio (i.e. using Istio sidecar).
  // Instead, use service-level annotations to overwrite the authentication policy.
  repeated string mtls_excluded_services = 15;

  // DEPRECATED. Mixer address. This option will be removed soon. Please
  // use mixer_check and mixer_report.
  string mixer_address = 16;

  message OutboundTrafficPolicy {
    enum Mode {
      // outbound traffic will be restricted to services defined in the service registry as well as those defined
      // through ServiceEntries
      REGISTRY_ONLY = 0;
      // outbound traffic to unknown destinations will be allowed
      ALLOW_ANY = 1;
      // not implemented. outbound traffic will be restricted to destinations defined in VirtualServices only
      VIRTUAL_SERVICE_ONLY = 2;
    }

    Mode mode = 1;
  }

  // Set the default behavior of the sidecar for handling outbound traffic from the application.
  // While the default mode should work out of the box, if your application uses one or more external services that
  // are not known apriori, setting the policy to ALLOW_ANY will cause the sidecars to route traffic to the any
  // requested destination.
  // Users are strongly encouraged to use ServiceEntries to explicitly declare any external dependencies,
  // instead of using allow_any.
  OutboundTrafficPolicy outbound_traffic_policy = 17;

  reserved 18;
}
