wasm.gen.json

{
  "openapi": "3.0.0",
  "info": {
    "title": "Extend the functionality provided by the Istio proxy through WebAssembly filters.",
    "version": "v1alpha1"
  },
  "components": {
    "schemas": {
      "istio.extensions.v1alpha1.CapabilityRestriction": {
        "description": "Capability restriction enforces limits on the Wasm ABI calls.",
        "type": "object",
        "properties": {
          "set": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.CapabilitySet"
          }
        }
      },
      "istio.extensions.v1alpha1.CapabilitySet": {
        "description": "A set of capabilities in the increasing order.",
        "type": "string",
        "enum": [
          "DEFAULT",
          "BASIC",
          "ADVANCED"
        ]
      },
      "istio.extensions.v1alpha1.EnvValueSource": {
        "type": "string",
        "enum": [
          "INLINE",
          "HOST"
        ]
      },
      "istio.extensions.v1alpha1.EnvVar": {
        "type": "object",
        "properties": {
          "name": {
            "description": "Required Name of the environment variable. Must be a C_IDENTIFIER.",
            "type": "string"
          },
          "valueFrom": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.EnvValueSource"
          },
          "value": {
            "description": "Value for the environment variable. Note that if `value_from` is `HOST`, it will be ignored. Defaults to \"\".",
            "type": "string"
          }
        }
      },
      "istio.extensions.v1alpha1.EventRestriction": {
        "description": "Event restrictions enforces limits on the callback to the Wasm module.",
        "type": "object",
        "properties": {
          "OnRequestHeaders": {
            "description": "Trigger Wasm execution on receiving the request headers.",
            "type": "boolean"
          },
          "OnRequestBody": {
            "description": "Trigger Wasm execution on receiving the request body.",
            "type": "boolean"
          },
          "OnResponseHeaders": {
            "description": "Trigger Wasm execution on receiving the response headers.",
            "type": "boolean"
          },
          "OnResponseBody": {
            "description": "Trigger Wasm execution on receiving the response body.",
            "type": "boolean"
          }
        }
      },
      "istio.extensions.v1alpha1.PluginPhase": {
        "description": "The phase in the filter chain where the plugin will be injected.",
        "type": "string",
        "enum": [
          "UNSPECIFIED_PHASE",
          "AUTHN",
          "AUTHZ",
          "STATS"
        ]
      },
      "istio.extensions.v1alpha1.PullPolicy": {
        "description": "The pull behaviour to be applied when fetching a Wam module, mirroring K8s behaviour.",
        "type": "string",
        "enum": [
          "UNSPECIFIED_POLICY",
          "IfNotPresent",
          "Always"
        ]
      },
      "istio.extensions.v1alpha1.VmConfig": {
        "description": "Configuration for a Wasm VM. more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).",
        "type": "object",
        "properties": {
          "env": {
            "description": "Specifies environment variables to be injected to this VM. Note that if a key does not exist, it will be ignored.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.extensions.v1alpha1.EnvVar"
            }
          }
        }
      },
      "istio.extensions.v1alpha1.WasmPlugin": {
        "description": "WasmPlugins provides a mechanism to extend the functionality provided by the Istio proxy through WebAssembly filters.",
        "type": "object",
        "properties": {
          "selector": {
            "$ref": "#/components/schemas/istio.type.v1beta1.WorkloadSelector"
          },
          "url": {
            "description": "URL of a Wasm module or OCI container. If no scheme is present, defaults to `oci://`, referencing an OCI image. Other valid schemes are `file://` for referencing .wasm module files present locally within the proxy container, and `http[s]://` for .wasm module files hosted remotely.",
            "type": "string"
          },
          "sha256": {
            "description": "SHA256 checksum that will be used to verify Wasm module or OCI container. If the `url` field already references a SHA256 (using the `@sha256:` notation), it must match the value of this field. If an OCI image is referenced by tag and this field is set, its checksum will be verified against the contents of this field after pulling.",
            "type": "string"
          },
          "imagePullPolicy": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.PullPolicy"
          },
          "imagePullSecret": {
            "description": "Credentials to use for OCI image pulling. Name of a K8s Secret in the same namespace as the `WasmPlugin` that contains a docker pull secret which is to be used to authenticate against the registry when pulling the image.",
            "type": "string"
          },
          "verificationKey": {
            "description": "Public key that will be used to verify signatures of signed OCI images or Wasm modules.",
            "type": "string"
          },
          "pluginConfig": {
            "description": "The configuration that will be passed on to the plugin.",
            "type": "object"
          },
          "pluginName": {
            "description": "The plugin name to be used in the Envoy configuration (used to be called `rootID`). Some .wasm modules might require this value to select the Wasm plugin to execute.",
            "type": "string"
          },
          "phase": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.PluginPhase"
          },
          "priority": {
            "description": "Determines ordering of `WasmPlugins` in the same `phase`. When multiple `WasmPlugins` are applied to the same workload in the same `phase`, they will be applied by priority, in descending order. If `priority` is not set, or two `WasmPlugins` exist with the same value, the ordering will be deterministically derived from name and namespace of the `WasmPlugins`. Defaults to `0`.",
            "type": "integer",
            "nullable": true
          },
          "vmConfig": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.VmConfig"
          },
          "match": {
            "description": "Specifies the criteria to determine which traffic is passed to WasmPlugin. If a traffic satisfies any of TrafficSelectors, the traffic passes the WasmPlugin.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.extensions.v1alpha1.WasmPlugin.TrafficSelector"
            }
          },
          "capabilities": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.CapabilityRestriction"
          },
          "events": {
            "$ref": "#/components/schemas/istio.extensions.v1alpha1.EventRestriction"
          }
        }
      },
      "istio.extensions.v1alpha1.WasmPlugin.TrafficSelector": {
        "description": "TrafficSelector provides a mechanism to select a specific traffic flow for which this Wasm Plugin will be enabled. When all the sub conditions in the TrafficSelector are satisfied, the traffic will be selected.",
        "type": "object",
        "properties": {
          "mode": {
            "$ref": "#/components/schemas/istio.type.v1beta1.WorkloadMode"
          },
          "ports": {
            "description": "Criteria for selecting traffic by their destination port. More specifically, for the outbound traffic, the destination port would be the port of the target service. On the other hand, for the inbound traffic, the destiation port is the port bound by the server process in the same Pod.",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/istio.type.v1beta1.PortSelector"
            }
          }
        }
      },
      "istio.type.v1beta1.PortSelector": {
        "description": "PortSelector is the criteria for specifying if a policy can be applied to a listener having a specific port.",
        "type": "object",
        "properties": {
          "number": {
            "description": "Port number",
            "type": "integer"
          }
        }
      },
      "istio.type.v1beta1.WorkloadMode": {
        "description": "WorkloadMode allows selection of the role of the underlying workload in network traffic. A workload is considered as acting as a SERVER if it is the destination of the traffic (that is, traffic direction, from the perspective of the workload is *inbound*). If the workload is the source of the network traffic, it is considered to be in CLIENT mode (traffic is *outbound* from the workload).",
        "type": "string",
        "enum": [
          "UNDEFINED",
          "CLIENT",
          "SERVER",
          "CLIENT_AND_SERVER"
        ]
      },
      "istio.type.v1beta1.WorkloadSelector": {
        "description": "WorkloadSelector specifies the criteria used to determine if a policy can be applied to a proxy. The matching criteria includes the metadata associated with a proxy, workload instance info such as labels attached to the pod/VM, or any other info that the proxy provides to Istio during the initial handshake. If multiple conditions are specified, all conditions need to match in order for the workload instance to be selected. Currently, only label based selection mechanism is supported.",
        "type": "object",
        "properties": {
          "matchLabels": {
            "description": "One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. The scope of label search is restricted to the configuration namespace in which the resource is present.",
            "type": "object",
            "additionalProperties": {
              "type": "string"
            }
          }
        }
      }
    }
  }
}