Sidecar.spec.ingress.connectionPool.tcp.tcpKeepalive.spec.ingress.tls

For mutual TLS, the name of the secret or the configmap that holds CA certificates.

REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.

OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.

Optional: If specified, only support the specified cipher list.

For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.

Same as CredentialName but for multiple certificates.

• minItems: 1
• maxItems: 2

If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.

Optional: If set to true, the proxy will try to validate the certificate, but even if the validation fails, it will allow the connection through.

• nullable

Optional: Maximum TLS protocol version. Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3

• enum: ["TLS_AUTO","TLSV1_0","TLSV1_1","TLSV1_2","TLSV1_3"]

Optional: Minimum TLS protocol version. Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3

• enum: ["TLS_AUTO","TLSV1_0","TLSV1_1","TLSV1_2","TLSV1_3"]

Optional: Indicates whether connections to this port should be secured using TLS. Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL

• enum: ["PASSTHROUGH","SIMPLE","MUTUAL","AUTO_PASSTHROUGH","ISTIO_MUTUAL","OPTIONAL_MUTUAL"]

REQUIRED if mode is `SIMPLE` or `MUTUAL`.

REQUIRED if mode is `SIMPLE` or `MUTUAL`.

A list of alternate names to verify the subject identity in the certificate presented by the client.

Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified.

• minItems: 1
• maxItems: 2

An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.

An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.