rancher-partner-charts/charts/airlock/microgateway/4.3.1/crds/headerrewrites.microgateway...

760 lines
50 KiB
YAML

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.15.0
labels:
app.kubernetes.io/name: airlock-microgateway-operator
app.kubernetes.io/version: 4.3.1
name: headerrewrites.microgateway.airlock.com
spec:
group: microgateway.airlock.com
names:
categories:
- airlock-microgateway
kind: HeaderRewrites
listKind: HeaderRewritesList
plural: headerrewrites
singular: headerrewrites
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: HeaderRewrites is the Schema for the headerrewrites API
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: Specification of the desired header rewriting behavior.
properties:
request:
description: Request defines manipulations on upstream request headers.
properties:
add:
description: Add defines which request headers will be added before forwarding to the upstream.
properties:
custom:
description: |-
Custom allows configuring additional upstream request headers.
Add selected headers.
items:
properties:
headers:
description: Headers to add.
items:
description: HeaderRewritesHeader specifies a header with a particular value
properties:
name:
description: Name defines the name of a header.
minLength: 1
type: string
value:
description: Value defines the value of a header.
type: string
required:
- name
- value
type: object
minItems: 1
type: array
mode:
default: AddIfAbsent
description: Mode defines the header addition strategy.
enum:
- AddIfAbsent
- OverwriteOrAdd
type: string
name:
description: Name describing the configured operation.
minLength: 1
type: string
required:
- headers
- name
type: object
minItems: 1
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
allow:
description: |-
Allow defines which request headers will be forwarded to the upstream.
This can either be allHeaders or matchingHeaders.
Default: matchingHeaders: {...}
properties:
allHeaders:
description: AllHeaders specifies that all request headers should be forwarded.
type: object
matchingHeaders:
description: MatchingHeaders specifies which request headers should be forwarded.
properties:
builtIn:
description: BuiltIn allows configuring a set of predefined upstream request headers.
properties:
standardHeaders:
default: true
description: StandardHeaders defines whether the request headers which are forwarded to the upstream will be restricted to a set of common request headers.
type: boolean
type: object
custom:
description: Custom allows configuring additional upstream request headers.
items:
properties:
headers:
description: Headers to allow.
items:
description: |-
HeaderMatcher defines a matcher for an HTTP header.
At least one of name and value must be set.
properties:
name:
description: Name defines the name of a header.
properties:
matcher:
description: Matcher defines the way to match a string. In comparison to a normal StringMatcher, a value is always matched ignoring the case and can't be inverted.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
value:
description: Value defines the value of a header.
properties:
matcher:
description: StringMatcher defines the way to match a string.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
ignoreCase:
default: false
description: IgnoreCase indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.
type: boolean
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
type: object
minItems: 1
type: array
name:
description: Name describing the configured operation. Must be unique.
minLength: 1
type: string
required:
- headers
- name
type: object
minItems: 1
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
type: object
remove:
description: Remove defines which request headers will be removed before forwarding to the upstream.
properties:
builtIn:
description: BuiltIn allows configuring a set of predefined upstream request headers.
properties:
alternativeForwardedHeaders:
default: true
description: |-
AlternativeForwardedHeaders removes downstream request headers which could potentially
be abused to alter the upstream's view of the remote connection.
type: boolean
type: object
custom:
description: Custom allows configuring additional upstream request headers.
items:
properties:
headers:
description: Headers to remove.
items:
description: |-
HeaderMatcher defines a matcher for an HTTP header.
At least one of name and value must be set.
properties:
name:
description: Name defines the name of a header.
properties:
matcher:
description: Matcher defines the way to match a string. In comparison to a normal StringMatcher, a value is always matched ignoring the case and can't be inverted.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
value:
description: Value defines the value of a header.
properties:
matcher:
description: StringMatcher defines the way to match a string.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
ignoreCase:
default: false
description: IgnoreCase indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.
type: boolean
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
type: object
minItems: 1
type: array
name:
description: Name describing the configured operation. Must be unique.
minLength: 1
type: string
required:
- headers
- name
type: object
minItems: 1
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
type: object
response:
description: Response defines manipulations on upstream response headers.
properties:
add:
description: Add defines which response headers will be added before forwarding to the downstream.
properties:
builtIn:
description: BuiltIn allows configuring a set of predefined upstream response headers.
properties:
csp:
default: true
description: |-
CSP sets a content security policy which allows only same-origin requests except for images
if the 'Content-Security-Policy' header is not set by the upstream.
type: boolean
featurePolicy:
default: false
description: |-
FeaturePolicy sets a feature policy which prevents cross-origin use of several browser features
if the 'Feature-Policy' header is not set by the upstream.
**Deprecated:** Use permissionsPolicy instead.
type: boolean
hsts:
default: true
description: HSTS enforces the use of HTTPS if the 'Strict-Transport-Security' header is not already set by the upstream.
type: boolean
hstsPreload:
default: false
description: HSTSPreload enforces the use of HTTPS including for subdomains and enables HSTS preload.
type: boolean
permissionsPolicy:
default: true
description: |-
PermissionsPolicy sets a permissions policy which prevents cross-origin use of several browser features
if the 'Permissions-Policy' header is not set by the upstream.
type: boolean
referrerPolicy:
default: true
description: |-
ReferrerPolicy ensures that no 'Referer' header is sent for cross-origin requests
if the 'Referrer-Policy' header is not set by the upstream.
type: boolean
xContentTypeOptions:
default: true
description: XContentTypeOptions sets 'X-Content-Type-Options' to 'nosniff' if it is not set by the upstream.
type: boolean
xFrameOptions:
default: true
description: XFrameOptions sets 'X-Frame-Options' to SAMEORIGIN if it is not set by the upstream.
type: boolean
type: object
custom:
description: Custom allows configuring additional upstream response headers.
items:
properties:
headers:
description: Headers to add.
items:
description: HeaderRewritesHeader specifies a header with a particular value
properties:
name:
description: Name defines the name of a header.
minLength: 1
type: string
value:
description: Value defines the value of a header.
type: string
required:
- name
- value
type: object
minItems: 1
type: array
mode:
default: AddIfAbsent
description: Mode defines the header addition strategy.
enum:
- AddIfAbsent
- OverwriteOrAdd
type: string
name:
description: Name describing the configured operation.
minLength: 1
type: string
required:
- headers
- name
type: object
minItems: 1
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
allow:
description: |-
Allow defines which response headers will be forwarded to the downstream.
This can either be allHeaders or matchingHeaders.
Default: allHeaders: {}
properties:
allHeaders:
description: AllHeaders specifies that all response headers should be forwarded.
type: object
matchingHeaders:
description: MatchingHeaders specifies which response headers should be forwarded.
properties:
builtIn:
description: BuiltIn allows configuring a set of predefined upstream response header.
properties:
standardHeaders:
default: false
description: StandardHeaders defines whether the response headers which are forwarded to the downstream will be restricted to a set of common response headers.
type: boolean
type: object
custom:
description: Custom allows configuring additional upstream response headers.
items:
properties:
headers:
description: Headers to allow.
items:
description: |-
HeaderMatcher defines a matcher for an HTTP header.
At least one of name and value must be set.
properties:
name:
description: Name defines the name of a header.
properties:
matcher:
description: Matcher defines the way to match a string. In comparison to a normal StringMatcher, a value is always matched ignoring the case and can't be inverted.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
value:
description: Value defines the value of a header.
properties:
matcher:
description: StringMatcher defines the way to match a string.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
ignoreCase:
default: false
description: IgnoreCase indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.
type: boolean
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
type: object
minItems: 1
type: array
name:
description: Name describing the configured operation. Must be unique.
minLength: 1
type: string
required:
- headers
- name
type: object
minItems: 1
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
type: object
remove:
description: Remove defines which response headers will be removed before forwarding to the downstream.
properties:
builtIn:
description: BuiltIn allows configuring a set of predefined upstream response headers.
properties:
auth:
description: Auth defines the categories of headers concerning authentication.
properties:
basic:
default: false
description: Basic removes upstream response headers that advise clients to authenticate with Basic Authentication.
type: boolean
negotiate:
default: true
description: Negotiate removes upstream response headers that advise clients to authenticate with Negotiate.
type: boolean
ntlm:
default: true
description: |-
NTLM removes upstream response headers that advise clients to authenticate with NTLM.
By default, these headers are removed, because NTLM pass-through is not supported.
type: boolean
type: object
informationLeakage:
description: InformationLeakage defines the categories of headers concerning information leakage.
properties:
application:
default: true
description: Application removes upstream response headers that leak information about the deployed software.
type: boolean
server:
default: true
description: Server removes upstream response headers that leak information about the server.
type: boolean
type: object
permissiveCors:
default: true
description: PermissiveCORS removes upstream response headers for CORS (Cross-Origin Resource Sharing) which have no restrictions and therefore reduce client-side security.
type: boolean
type: object
custom:
description: Custom allows configuring additional upstream response headers.
items:
properties:
headers:
description: Headers to remove.
items:
description: |-
HeaderMatcher defines a matcher for an HTTP header.
At least one of name and value must be set.
properties:
name:
description: Name defines the name of a header.
properties:
matcher:
description: Matcher defines the way to match a string. In comparison to a normal StringMatcher, a value is always matched ignoring the case and can't be inverted.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
value:
description: Value defines the value of a header.
properties:
matcher:
description: StringMatcher defines the way to match a string.
properties:
contains:
description: |-
Contains defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
exact:
description: |-
Exact defines an explicit match on the string specified here.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
ignoreCase:
default: false
description: IgnoreCase indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.
type: boolean
prefix:
description: |-
Prefix defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
regex:
description: |-
Regex defines a regex match on the regular expression specified here. Google's [RE2 regex engine](https://github.com/google/re2/wiki/Syntax) is used.
The regex matches only single-line by default, even with ".*". To match a multi-line string prepend (?s) to your regex.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
suffix:
description: |-
Suffix defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead.
Only one of exact, prefix, suffix, regex or contains can be set.
minLength: 1
type: string
type: object
required:
- matcher
type: object
type: object
minItems: 1
type: array
name:
description: Name describing the configured remove operation. Must be unique.
minLength: 1
type: string
required:
- headers
- name
type: object
minItems: 1
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
type: object
type: object
settings:
description: Settings configures the HeaderRewrites filter.
properties:
operationalMode:
default: Production
description: OperationalMode defines the behavior of the filter. In integration mode more information is logged about the requests and responses.
enum:
- Production
- Integration
type: string
type: object
type: object
type: object
served: true
storage: true