Project: Gloo (Orchestration & Management / API Gateway)
File: options.proto.sk.md

title: "options.proto" weight: 5 <!-- Code generated by solo-kit. DO NOT EDIT. --> Optional, feature-specific configuration that lives on gateways. Each ListenerOption object contains configuration for a specific feature. Note to developers: new Listener plugins must be added to this struct to be usable by Gloo. (plugins currently need to be compiled into Gloo) ```yaml "accessLoggingService": .als.options.gloo.solo.io.AccessLoggingService "extensions": .gloo.solo.io.Extensions "perConnectionBufferLimitBytes": .google.protobuf.UInt32Value "socketOptions": []solo.io.envoy.api.v2.core.SocketOption "proxyProtocol": .proxy_protocol.options.gloo.solo.io.ProxyProtocol "connectionBalanceConfig": .gloo.solo.io.ConnectionBalanceConfig "listenerAccessLoggingService": .als.options.gloo.solo.io.AccessLoggingService ``` | Field | Type | Description | | -- | - | -- | | `accessLoggingService` | | Configuration for access logging in a filter like the HttpConnectionManager. | | `extensions` | | Extensions will be passed along from Listeners, Gateways, VirtualServices, Routes, and Route tables to the underlying Proxy, making them useful for controllers, validation tools, etc. which interact with kubernetes yaml. Some sample use cases: controllers, deployment pipelines, helm charts, etc. which wish to use extensions as a kind of opaque metadata. In the future, Gloo may support gRPC-based plugins which communicate with the Gloo translator out-of-process. Opaque Extensions enables development of out-of-process plugins without requiring recompiling & redeploying Gloo's API. | | `perConnectionBufferLimitBytes` | | Soft limit on size of the listener's new connection read and write buffers. If unspecified, defaults to 1MiB For more info, check out the . | | `socketOptions` | | Additional socket options that may not be present in Envoy source code or precompiled binaries. | | `proxyProtocol` | | Enable ProxyProtocol support for this listener. | | `connectionBalanceConfig` | | Configuration for listener connection balancing. | | `listenerAccessLoggingService` | | If enabled this sets up an early access logging service for the listener. Added initially to support listener level logging for HTTP listeners. For more info see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-access-log. | Configuration for listener connection balancing. ```yaml "exactBalance": .gloo.solo.io.ConnectionBalanceConfig.ExactBalance ``` | Field | Type | Description | | -- | - | -- | | `exactBalance` | | | A connection balancer implementation that does exact balancing. This means that a lock is held during balancing so that connection counts are nearly exactly balanced between worker threads. This is "nearly" exact in the sense that a connection might close in parallel thus making the counts incorrect, but this should be rectified on the next accept. This balancer sacrifices accept throughput for accuracy and should be used when there are a small number of connections that rarely cycle (e.g., service mesh gRPC egress). ```yaml ``` | Field | Type | Description | | -- | - | -- | ```yaml "maxDirectResponseBodySizeBytes": .google.protobuf.UInt32Value "mostSpecificHeaderMutationsWins": .google.protobuf.BoolValue ``` | Field | Type | Description | | -- | - | -- | | `maxDirectResponseBodySizeBytes` | | The maximum bytes of the response direct response body size. If not specified the default is 4096. Please refer to the for more details about the `maxdirectresponsebodysize_bytes` attribute. | | `mostSpecificHeaderMutationsWins` | | By default, headers that should be added/removed are evaluated from most to least specific. To allow setting overrides at the route or virtual host level, this order can be reversed by setting this option to true. Refer to the for more details. | Optional, feature-specific configuration that lives on http listeners ```yaml "grpcWeb": .grpc_web.options.gloo.solo.io.GrpcWeb "httpConnectionManagerSettings": .hcm.options.gloo.solo.io.HttpConnectionManagerSettings "healthCheck": .healthcheck.options.gloo.solo.io.HealthCheck "extensions": .gloo.solo.io.Extensions "waf": .waf.options.gloo.solo.io.Settings "dlp": .dlp.options.gloo.solo.io.FilterConfig "wasm": .wasm.options.gloo.solo.io.PluginSource "extauth": .enterprise.gloo.solo.io.Settings "ratelimitServer": .ratelimit.options.gloo.solo.io.Settings "caching": .caching.options.gloo.solo.io.Settings "disableExtProc": .google.protobuf.BoolValue "extProc": .extproc.options.gloo.solo.io.Settings "gzip": .solo.io.envoy.config.filter.http.gzip.v2.Gzip "proxyLatency": .envoy.config.filter.http.proxylatency.v2.ProxyLatency "buffer": .solo.io.envoy.extensions.filters.http.buffer.v3.Buffer "csrf": .solo.io.envoy.extensions.filters.http.csrf.v3.CsrfPolicy "grpcJsonTranscoder": .grpc_json.options.gloo.solo.io.GrpcJsonTranscoder "sanitizeClusterHeader": .google.protobuf.BoolValue "leftmostXffAddress": .google.protobuf.BoolValue "dynamicForwardProxy": .dfp.options.gloo.solo.io.FilterConfig "connectionLimit": .connection_limit.options.gloo.solo.io.ConnectionLimit "networkLocalRatelimit": .local_ratelimit.options.gloo.solo.io.TokenBucket "httpLocalRatelimit": .local_ratelimit.options.gloo.solo.io.Settings "router": .gloo.solo.io.Router "tap":

``` | Field | Type | Description | | -- | - | -- | | `grpcWeb` | | | | `httpConnectionManagerSettings` | | | | `healthCheck` | | enable on this listener. | | `extensions` | | Extensions will be passed along from Listeners, Gateways, VirtualServices, Routes, and Route tables to the underlying Proxy, making them useful for controllers, validation tools, etc. which interact with kubernetes yaml. Some sample use cases: controllers, deployment pipelines, helm charts, etc. which wish to use extensions as a kind of opaque metadata. In the future, Gloo may support gRPC-based plugins which communicate with the Gloo translator out-of-process. Opaque Extensions enables development of out-of-process plugins without requiring recompiling & redeploying Gloo's API. | | `waf` | | Enterprise-only: Config for Web Application Firewall (WAF), supporting the popular ModSecurity 3.0 ruleset. | | `dlp` | | Enterprise-only: Config for data loss prevention. | | `wasm` | | Enterprise-only: WASM related configuration [experimental!]. | | `extauth` | | Enterprise-only: External auth related settings. | | `ratelimitServer` | | Enterprise-only: Settings for the rate limiting server itself. | | `caching` | | Enterprise-only: Settings for the cache server itself. | | `disableExtProc` | | Enterprise-only: Set to true to disable the External Processing filter for this listener. This can be overridden by child VirtualHostOptions or RouteOptions. Only one of `disableExtProc` or `extProc` can be set. | | `extProc` | | Enterprise-only: External Processing filter settings for the listener. This can be used to override the defaults from the global settings (via shallow merge). Some of the settings on the listener can be overridden by child VirtualHostOptions or RouteOptions. Only one of `extProc` or `disableExtProc` can be set. | | `gzip` | | Gzip is an HTTP option which enables Gloo to compress data returned from an upstream service upon client request. Compression is useful in situations where large payloads need to be transmitted without compromising the response time. Example: ``` gzip: contentType: - "application/json" compressionLevel: BEST ```. | | `proxyLatency` | | Enterprise-only: Proxy latency. | | `buffer` | | Buffer can be used to set the maximum request size that the filter will buffer before the connection manager will stop buffering and return a 413 response. | | `csrf` | | Csrf can be used to set percent of requests for which the CSRF filter is enabled, enable shadow-only mode where policies will be evaluated and tracked, but not enforced and add additional source origins that will be allowed in addition to the destination origin. For more, see https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/http/csrf/v2/csrf.proto. | | `grpcJsonTranscoder` | | Exposed envoy config for the gRPC to JSON transcoding filter, envoy.filters.http.grpcjsontranscoder. For more, see https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/grpcjsontranscoder/v3/transcoder.proto. | | `sanitizeClusterHeader` | | Enterprise-only: If using the HTTP header specified by cluster_header to direct traffic to a cluster, this option will sanitize that header from downstream traffic. Defaults to false. | | `leftmostXffAddress` | | Enterprise-only: Setting this value to true will grab the leftmost IP address from the x-forwarded-for header and set it as the downstream address. It is worth noting that the x-forwarded-for header can be tampered with by clients and should therefore be sanitized by any preceding proxies / load balancers if this option is to be used. | | `dynamicForwardProxy` | | | | `connectionLimit` | | ConnectionLimit can be used to limit the number of active connections per gateway. Useful for resource protection as well as DoS prevention. | | `networkLocalRatelimit` | | NetworkLocalRatelimit can be used to rate limit the connections per gateway at the L4 layer and works

It uses envoy's own local rate limit filter to do so, without the need for an external rate limit server to be set up. | | `httpLocalRatelimit` | | HttpLocalRatelimit can be used to rate limit the number of requests per gateway and works pre-auth. Unlike the NetworkLocalRatelimit, this works as part of the HCM (ie: L7 layer). All virtual host and routes that are part of this gateway will share this rate limit unless explicity configured with another limit. It uses envoy's own local rate limit filter to do so, without the need for an external rate limit server to be set up. | | `router` | | Router is an extension of the envoy http filters Maps to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto. | | `tap` | | Enterprise only: Tap filter settings (experimental). | Optional, feature-specific configuration that lives on tcp listeners ```yaml "tcpProxySettings": .tcp.options.gloo.solo.io.TcpProxySettings "connectionLimit": .connection_limit.options.gloo.solo.io.ConnectionLimit "localRatelimit": .local_ratelimit.options.gloo.solo.io.TokenBucket ``` | Field | Type | Description | | -- | - | -- | | `tcpProxySettings` | | | | `connectionLimit` | | ConnectionLimit can be used to limit the number of active connections per gateway. Useful for resource protection as well as DoS prevention. | | `localRatelimit` | | LocalRatelimit can be used to rate limit the connections per gateway at the L4 layer. It uses envoy's own local rate limit filter to do so, without the need for an external rate limit server to be set up. | Optional, feature-specific configuration that lives on virtual hosts. Each VirtualHostOptions object contains configuration for a specific feature. Note to developers: new Virtual Host plugins must be added to this struct to be usable by Gloo. (plugins currently need to be compiled into Gloo) ```yaml "extensions": .gloo.solo.io.Extensions "retries": .retries.options.gloo.solo.io.RetryPolicy "stats": .stats.options.gloo.solo.io.Stats "headerManipulation": .headers.options.gloo.solo.io.HeaderManipulation "cors": .cors.options.gloo.solo.io.CorsPolicy "transformations": .transformation.options.gloo.solo.io.Transformations "ratelimitBasic": .ratelimit.options.gloo.solo.io.IngressRateLimit "ratelimitEarly": .ratelimit.options.gloo.solo.io.RateLimitVhostExtension "rateLimitEarlyConfigs": .ratelimit.options.gloo.solo.io.RateLimitConfigRefs "ratelimit": .ratelimit.options.gloo.solo.io.RateLimitVhostExtension "rateLimitConfigs": .ratelimit.options.gloo.solo.io.RateLimitConfigRefs "ratelimitRegular": .ratelimit.options.gloo.solo.io.RateLimitVhostExtension "rateLimitRegularConfigs": .ratelimit.options.gloo.solo.io.RateLimitConfigRefs "waf": .waf.options.gloo.solo.io.Settings "jwt": .jwt.options.gloo.solo.io.VhostExtension "jwtStaged": .jwt.options.gloo.solo.io.JwtStagedVhostExtension "rbac": .rbac.options.gloo.solo.io.ExtensionSettings "extauth": .enterprise.gloo.solo.io.ExtAuthExtension "dlp": .dlp.options.gloo.solo.io.Config "bufferPerRoute": .solo.io.envoy.extensions.filters.http.buffer.v3.BufferPerRoute "csrf": .solo.io.envoy.extensions.filters.http.csrf.v3.CsrfPolicy "includeRequestAttemptCount": .google.protobuf.BoolValue "includeAttemptCountInResponse": .google.protobuf.BoolValue "stagedTransformations": .transformation.options.gloo.solo.io.TransformationStages "extProc": .extproc.options.gloo.solo.io.RouteSettings ``` | Field | Type | Description | | -- | - | -- | | `extensions` | | Extensions will be passed along from Listeners, Gateways, VirtualServices, Routes, and Route tables to the underlying Proxy, making them useful for controllers, validation tools, etc. which interact with kubernetes yaml. Some sample use cases: controllers, deployment pipelines, helm charts, etc. which wish to use extensions as a kind of opaque metadata. In the future, Gloo may support gRPC-based plugins which communicate with the Gloo translator out-of-process. Opaque Extensions enables development of out-of-process plugins without requiring recompiling & redeploying Gloo's API. | | `retries` | | | | `stats` | | | | `headerManipulation` | | Append/Remove headers on Requests or Responses on all routes contained in this Virtual Host. | | `cors` | | Defines a CORS policy for the virtual host If a CORS policy is also defined on the route matched by the request, the policies are merged. | | `transformations` | | Transformations to apply. Note: this field is superseded by `stagedtransformations`. If `stagedtransformations.regular` is set, this field will be ignored. | | `ratelimitBasic` | | Enterprise-only: Config for GlooE rate-limiting using simplified (gloo-specific) API. | | `ratelimitEarly` | | Enterprise-only: Partial config for GlooE rate-limiting based on Envoy's rate-limit service; supports Envoy's rate-limit service API. (reference here: https://github.com/lyft/ratelimit#configuration) Configure rate-limit actions here, which define how request characteristics get translated into descriptors used by the rate-limit service for rate-limiting. Configure rate-limit descriptors and their associated limits on the Gloo

Only one of `ratelimitearly` or `ratelimitearlyconfigs` can be set. Only one of `ratelimitEarly` or `rateLimitEarlyConfigs` can be set. | | `rateLimitEarlyConfigs` | | References to RateLimitConfig resources. This is used to configure the GlooE rate limit server. Only one of `ratelimitearly` or `ratelimitearlyconfigs` can be set. Only one of `rateLimitEarlyConfigs` or `ratelimitEarly` can be set. | | `ratelimit` | | Enterprise-only: Partial config for GlooE rate-limiting based on Envoy's rate-limit service; supports Envoy's rate-limit service API. (reference here: https://github.com/lyft/ratelimit#configuration) Configure rate-limit actions here, which define how request characteristics get translated into descriptors used by the rate-limit service for rate-limiting. Configure rate-limit descriptors and their associated limits on the Gloo settings. Only one of `ratelimit` or `ratelimitconfigs` can be set. Only one of `ratelimit` or `rateLimitConfigs` can be set. | | `rateLimitConfigs` | | References to RateLimitConfig resources. This is used to configure the GlooE rate limit server. Only one of `ratelimit` or `ratelimitconfigs` can be set. Only one of `rateLimitConfigs` or `ratelimit` can be set. | | `ratelimitRegular` | | Enterprise-only: Partial config for GlooE rate-limiting based on Envoy's rate-limit service; supports Envoy's rate-limit service API. (reference here: https://github.com/lyft/ratelimit#configuration) Configure rate-limit actions here, which define how request characteristics get translated into descriptors used by the rate-limit service for rate-limiting. Configure rate-limit descriptors and their associated limits on the Gloo settings. Only one of `ratelimitregular` or `ratelimitregularconfigs` can be set. Only one of `ratelimitRegular` or `rateLimitRegularConfigs` can be set. | | `rateLimitRegularConfigs` | | References to RateLimitConfig resources. This is used to configure the GlooE rate limit server. Only one of `ratelimitregular` or `ratelimitregularconfigs` can be set. Only one of `rateLimitRegularConfigs` or `ratelimitRegular` can be set. | | `waf` | | Enterprise-only: Config for Web Application Firewall (WAF), supporting the popular ModSecurity 3.0 ruleset. | | `jwt` | | Enterprise-only: Config for reading and verifying JWTs. Copy verifiable information from JWTs into other headers to make routing decisions or combine with RBAC for fine-grained access control. This has been deprecated in favor of staged jwt. The same configuration can be achieved through staged jwt using AfterExtAuth. Only one of `jwt` or `jwtStaged` can be set. | | `jwtStaged` | | Enterprise-only: Config for reading and verifying JWTs. Copy verifiable information from JWTs into other headers to make routing decisions or combine with RBAC for fine-grained access control. JWT configuration has stages "BeforeExtAuth" and "AfterExtAuth". BeforeExtAuth JWT validation runs before the external authentication service. This is useful when JWT is used in conjunction with other auth mechanisms specified in the . AfterExtAuth validation runs after external authentication service, which is useful for verifying JWTs obtained during extauth (e.g. oauth/oidc). Only one of `jwtStaged` or `jwt` can be set. | | `rbac` | | Enterprise-only: Config for RBAC (currently only supports RBAC based on JWT claims). | | `extauth` | | Enterprise-only: Authentication configuration. | | `dlp` | | Enterprise-only: Config for data loss prevention. | | `bufferPerRoute` | | BufferPerRoute can be used to set the maximum request size that the filter will buffer before the connection manager will stop buffering and return a 413 response. Note: If you have not set a global config (at the gateway level), this override will not do anything by itself. | | `csrf` | | Csrf can be used to set percent of requests for which the CSRF filter is enabled, enable shadow-only mode where policies will be evaluated and tracked, but not enforced and add additional source origins that will be allowed in addition to the destination

For more, see https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/http/csrf/v2/csrf.proto. | | `includeRequestAttemptCount` | | IncludeRequestAttemptCount decides whether the x-envoy-attempt-count header should be included in the upstream request. Setting this option will cause it to override any existing header value, so in the case of two Envoys on the request path with this option enabled, the upstream will see the attempt count as perceived by the second Envoy. Defaults to false. | | `includeAttemptCountInResponse` | | IncludeAttemptCountInResponse decides whether the x-envoy-attempt-count header should be included in the downstream response. Setting this option will cause the router to override any existing header value, so in the case of two Envoys on the request path with this option enabled, the downstream will see the attempt count as perceived by the Envoy closest upstream from itself. Defaults to false. | | `stagedTransformations` | | Early transformations stage. These transformations run before most other options are processed. If the `regular` field is set in here, the `transformations` field is ignored. | | `extProc` | | Enterprise-only: External Processing filter settings for the virtual host. This can be used to override certain HttpListenerOptions settings, and can be overridden by RouteOptions settings. | Optional, feature-specific configuration that lives on routes. Each RouteOptions object contains configuration for a specific feature. Note to developers: new Route plugins must be added to this struct to be usable by Gloo. (plugins currently need to be compiled into Gloo) ```yaml "transformations": .transformation.options.gloo.solo.io.Transformations "faults": .fault.options.gloo.solo.io.RouteFaults "prefixRewrite": .google.protobuf.StringValue "timeout": .google.protobuf.Duration "retries": .retries.options.gloo.solo.io.RetryPolicy "extensions": .gloo.solo.io.Extensions "tracing": .tracing.options.gloo.solo.io.RouteTracingSettings "shadowing": .shadowing.options.gloo.solo.io.RouteShadowing "headerManipulation": .headers.options.gloo.solo.io.HeaderManipulation "hostRewrite": string "autoHostRewrite": .google.protobuf.BoolValue "hostRewritePathRegex": .solo.io.envoy.type.matcher.v3.RegexMatchAndSubstitute "appendXForwardedHost": .google.protobuf.BoolValue "cors": .cors.options.gloo.solo.io.CorsPolicy "lbHash": .lbhash.options.gloo.solo.io.RouteActionHashConfig "upgrades": []protocol_upgrade.options.gloo.solo.io.ProtocolUpgradeConfig "ratelimitBasic": .ratelimit.options.gloo.solo.io.IngressRateLimit "ratelimitEarly": .ratelimit.options.gloo.solo.io.RateLimitRouteExtension "rateLimitEarlyConfigs": .ratelimit.options.gloo.solo.io.RateLimitConfigRefs "ratelimit": .ratelimit.options.gloo.solo.io.RateLimitRouteExtension "rateLimitConfigs": .ratelimit.options.gloo.solo.io.RateLimitConfigRefs "ratelimitRegular": .ratelimit.options.gloo.solo.io.RateLimitRouteExtension "rateLimitRegularConfigs": .ratelimit.options.gloo.solo.io.RateLimitConfigRefs "waf": .waf.options.gloo.solo.io.Settings "jwt": .jwt.options.gloo.solo.io.RouteExtension "jwtStaged": .jwt.options.gloo.solo.io.JwtStagedRouteExtension "rbac": .rbac.options.gloo.solo.io.ExtensionSettings "extauth": .enterprise.gloo.solo.io.ExtAuthExtension "dlp": .dlp.options.gloo.solo.io.Config "bufferPerRoute": .solo.io.envoy.extensions.filters.http.buffer.v3.BufferPerRoute "csrf": .solo.io.envoy.extensions.filters.http.csrf.v3.CsrfPolicy "stagedTransformations": .transformation.options.gloo.solo.io.TransformationStages "envoyMetadata": map<string, .google.protobuf.Struct> "regexRewrite": .solo.io.envoy.type.matcher.v3.RegexMatchAndSubstitute "maxStreamDuration": .gloo.solo.io.RouteOptions.MaxStreamDuration "idleTimeout": .google.protobuf.Duration "extProc": .extproc.options.gloo.solo.io.RouteSettings ``` | Field | Type | Description | | -- | - | -- | | `transformations` | | Transformations to apply. Note: this field is superseded by `stagedtransformations`. If `stagedtransformations.regular` is set, this field will be ignored. | | `faults` | | | | `prefixRewrite` | | For requests matched on this route, rewrite the HTTP request path to the provided value before forwarding upstream. | | `timeout` | | Specifies the upstream timeout for the route. If not specified, the default is 15s. This spans between the point at which the entire downstream request (i.e. end-of-stream) has been processed and when the upstream response has been completely processed. A value of 0 will disable the routes timeout. | | `retries` | | | | `extensions` | | Extensions will be passed along from Listeners, Gateways, VirtualServices, Routes, and Route tables to the underlying Proxy, making them useful for controllers, validation tools, etc. which interact with kubernetes yaml. Some sample use cases: controllers, deployment pipelines, helm charts, etc. which wish to use extensions as a kind of opaque metadata. In the future, Gloo may support gRPC-based plugins which communicate with the Gloo translator out-of-process. Opaque Extensions enables development of out-of-process plugins without requiring recompiling & redeploying Gloo's API. | | `tracing` | | Defines route-specific tracing configuration. See here for additional information on Envoy's tracing capabilities: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/tracing.html See for additional information about configuring tracing with Gloo Edge. | | `shadowing` | | Specifies traffic shadowing configuration for the route. See here for additional information on Envoy's shadowing capabilities: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto#envoy-api-msg-route-routeaction-requestmirrorpolicy. | | `headerManipulation` | | Append/Remove headers on Requests or Responses on this

| | `hostRewrite` | `string` | Indicates that during forwarding, the host header will be swapped with this value. Only one of `hostRewrite`, `autoHostRewrite`, or `hostRewritePathRegex` can be set. | | `autoHostRewrite` | | Enable/Disable auto host re-write. Indicates that the host header will be swapped with the hostname of the upstream host. This setting is only honored for upstreams that use DNS resolution (i.e., their generated Envoy cluster is of type STRICTDNS or LOGICALDNS -- think aws, azure, or static upstreams with hostnames). Only one of `autoHostRewrite`, `hostRewrite`, or `hostRewritePathRegex` can be set. | | `hostRewritePathRegex` | | Indicates that during forwarding, the host header will be swapped with the result of the regex substitution executed on path value with query and fragment removed. Only one of `hostRewritePathRegex`, `hostRewrite`, or `autoHostRewrite` can be set. | | `appendXForwardedHost` | | If true and there is a host rewrite, appends the x-forwarded-host header to requests. | | `cors` | | Defines a CORS policy for the route If a CORS policy is also defined on the route's virtual host, the policies are merged. | | `lbHash` | | For routes served by a hashing load balancer, this defines the input to the hash key Gloo configures Envoy with the first available RouteActionHashConfig among the following ordered list of providers: - route, upstream, virtual service. | | `upgrades` | | Route configuration for protocol upgrade requests. | | `ratelimitBasic` | | Enterprise-only: Config for GlooE rate-limiting using simplified (gloo-specific) API. | | `ratelimitEarly` | | Enterprise-only: Partial config for GlooE rate-limiting based on Envoy's rate-limit service; supports Envoy's rate-limit service API. (reference here: https://github.com/lyft/ratelimit#configuration) Configure rate-limit actions here, which define how request characteristics get translated into descriptors used by the rate-limit service for rate-limiting. Configure rate-limit descriptors and their associated limits on the Gloo settings. Only one of `ratelimitearly` or `ratelimitearlyconfigs` can be set. Only one of `ratelimitEarly` or `rateLimitEarlyConfigs` can be set. | | `rateLimitEarlyConfigs` | | References to RateLimitConfig resources. This is used to configure the GlooE rate limit server. Only one of `ratelimitearly` or `ratelimitearlyconfigs` can be set. Only one of `rateLimitEarlyConfigs` or `ratelimitEarly` can be set. | | `ratelimit` | | Enterprise-only: Partial config for GlooE rate-limiting based on Envoy's rate-limit service; supports Envoy's rate-limit service API. (reference here: https://github.com/lyft/ratelimit#configuration) Configure rate-limit actions here, which define how request characteristics get translated into descriptors used by the rate-limit service for rate-limiting. Configure rate-limit descriptors and their associated limits on the Gloo settings. Only one of `ratelimit` or `ratelimitconfigs` can be set. Only one of `ratelimit` or `rateLimitConfigs` can be set. | | `rateLimitConfigs` | | References to RateLimitConfig resources. This is used to configure the GlooE rate limit server. Only one of `ratelimit` or `ratelimitconfigs` can be set. Only one of `rateLimitConfigs` or `ratelimit` can be set. | | `ratelimitRegular` | | Enterprise-only: Partial config for GlooE rate-limiting based on Envoy's rate-limit service; supports Envoy's rate-limit service API. (reference here: https://github.com/lyft/ratelimit#configuration) Configure rate-limit actions here, which define how request characteristics get translated into descriptors used by the rate-limit service for rate-limiting. Configure rate-limit descriptors and their associated limits on the Gloo settings. Only one of `ratelimitearly` or `ratelimitearlyconfigs` can be set. Only one of `ratelimitRegular` or `rateLimitRegularConfigs` can be set. | | `rateLimitRegularConfigs` | | References to RateLimitConfig resources. This is used to configure the GlooE rate limit server. Only one of `ratelimitearly` or `ratelimitearlyconfigs` can be set. Only one of `rateLimitRegularConfigs` or `ratelimitRegular` can be

| | `waf` | | Enterprise-only: Config for Web Application Firewall (WAF), supporting the popular ModSecurity 3.0 ruleset. | | `jwt` | | Enterprise-only: Config for reading and verifying JWTs. Copy verifiable information from JWTs into other headers to make routing decisions or combine with RBAC for fine-grained access control. This has been deprecated in favor of staged jwt. The same configuration can be achieved through staged jwt using AfterExtAuth. Only one of `jwt` or `jwtStaged` can be set. | | `jwtStaged` | | Enterprise-only: Config for reading and verifying JWTs. Copy verifiable information from JWTs into other headers to make routing decisions or combine with RBAC for fine-grained access control. JWT configuration has stages "BeforeExtAuth" and "AfterExtAuth". BeforeExtAuth JWT validation runs before the external authentication service. This is useful when JWT is used in conjunction with other auth mechanisms specified in the . AfterExtAuth validation runs after external authentication service, which is useful for verifying JWTs obtained during extauth (e.g. oauth/oidc). Only one of `jwtStaged` or `jwt` can be set. | | `rbac` | | Enterprise-only: Config for RBAC (currently only supports RBAC based on JWT claims). | | `extauth` | | Enterprise-only: Authentication configuration. | | `dlp` | | Enterprise-only: Config for data loss prevention. | | `bufferPerRoute` | | BufferPerRoute can be used to set the maximum request size that the filter will buffer before the connection manager will stop buffering and return a 413 response. Note: If you have not set a global config (at the gateway level), this override will not do anything by itself. | | `csrf` | | Csrf can be used to set percent of requests for which the CSRF filter is enabled, enable shadow-only mode where policies will be evaluated and tracked, but not enforced and add additional source origins that will be allowed in addition to the destination origin. For more, see https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/http/csrf/v2/csrf.proto. | | `stagedTransformations` | | Early transformations stage. These transformations run before most other options are processed. If the `regular` field is set in here, the `transformations` field is ignored. | | `envoyMetadata` | `map<string, .google.protobuf.Struct>` | This field can be used to provide additional information about the route. This metadata can be consumed by the Envoy filters that process requests that match the route. For more info about metadata, see . The value of this field will be propagated to the `metadata` attribute of the corresponding Envoy route. Please refer to the for more details about the `metadata` attribute. | | `regexRewrite` | | For requests matched on this route, rewrite the HTTP request path according to the provided regex pattern before forwarding upstream Please refer to the for more details about the `regex_rewrite` attribute. | | `maxStreamDuration` | | Settings for maximum durations and timeouts for streams on the route. Please refer to the . | | `idleTimeout` | | Specifies the idle timeout for the route. If not specified, there is no per-route idle timeout, although the Gateway's wide streamidletimeout will still apply. A value of 0 will completely disable the routes idle timeout, even if a connection manager stream idle timeout is configured. Please refer to the . | | `extProc` | | Enterprise-only: External Processing filter settings for the route. This can be used to override certain HttpListenerOptions or VirtualHostOptions settings. | This is a 1:1 translation to the ```yaml "maxStreamDuration": .google.protobuf.Duration "grpcTimeoutHeaderMax": .google.protobuf.Duration "grpcTimeoutHeaderOffset": .google.protobuf.Duration ``` | Field | Type | Description | | -- | - | -- | | `maxStreamDuration` | | Specifies the maximum duration allowed for streams on the

If not specified, the value from the field in is used. If this field is set explicitly to zero, any HttpConnectionManager maxstreamduration timeout will be disabled for this route. | | `grpcTimeoutHeaderMax` | | If present, and the request contains a , use that value as the `maxstreamduration`, but limit the applied timeout to the maximum value specified here. If set to 0, the `grpc-timeout` header is used without modification. | | `grpcTimeoutHeaderOffset` | | If present, Envoy will adjust the timeout provided by the `grpc-timeout` header by subtracting the provided duration from the header. This is useful for allowing Envoy to set its global timeout to be less than that of the deadline imposed by the calling client, which makes it more likely that Envoy will handle the timeout instead of having the call canceled by the client. If, after applying the offset, the resulting timeout is zero or negative, the stream will timeout immediately. | Configuration for Destinations that are tied to the UpstreamSpec or ServiceSpec on that destination ```yaml "aws": .aws.options.gloo.solo.io.DestinationSpec "azure": .azure.options.gloo.solo.io.DestinationSpec "rest": .rest.options.gloo.solo.io.DestinationSpec "grpc": .grpc.options.gloo.solo.io.DestinationSpec ``` | Field | Type | Description | | -- | - | -- | | `aws` | | Only one of `aws`, `azure`, `rest`, or `grpc` can be set. | | `azure` | | Only one of `azure`, `aws`, `rest`, or `grpc` can be set. | | `rest` | | Only one of `rest`, `aws`, `azure`, or `grpc` can be set. | | `grpc` | | Only one of `grpc`, `aws`, `azure`, or `rest` can be set. | Optional, feature-specific configuration that is applied when a specific weighted destination is selected for routing. ```yaml "headerManipulation": .headers.options.gloo.solo.io.HeaderManipulation "transformations": .transformation.options.gloo.solo.io.Transformations "extensions": .gloo.solo.io.Extensions "extauth": .enterprise.gloo.solo.io.ExtAuthExtension "bufferPerRoute": .solo.io.envoy.extensions.filters.http.buffer.v3.BufferPerRoute "csrf": .solo.io.envoy.extensions.filters.http.csrf.v3.CsrfPolicy "stagedTransformations": .transformation.options.gloo.solo.io.TransformationStages ``` | Field | Type | Description | | -- | - | -- | | `headerManipulation` | | Append/Remove headers on Requests or Responses to/from this Weighted Destination. | | `transformations` | | Transformations to apply. Note: this field is superseded by `stagedtransformations`. If `stagedtransformations.regular` is set, this field will be ignored. | | `extensions` | | Extensions will be passed along from Listeners, Gateways, VirtualServices, Routes, and Route tables to the underlying Proxy, making them useful for controllers, validation tools, etc. which interact with kubernetes yaml. Some sample use cases: controllers, deployment pipelines, helm charts, etc. which wish to use extensions as a kind of opaque metadata. In the future, Gloo may support gRPC-based plugins which communicate with the Gloo translator out-of-process. Opaque Extensions enables development of out-of-process plugins without requiring recompiling & redeploying Gloo's API. | | `extauth` | | Enterprise-only: Authentication configuration. | | `bufferPerRoute` | | BufferPerRoute can be used to set the maximum request size that the filter will buffer before the connection manager will stop buffering and return a 413 response. Note: If you have not set a global config (at the gateway level), this override will not do anything by itself. | | `csrf` | | Csrf can be used to set percent of requests for which the CSRF filter is enabled, enable shadow-only mode where policies will be evaluated and tracked, but not enforced and add additional source origins that will be allowed in addition to the destination origin. For more, see https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/http/csrf/v2/csrf.proto. | | `stagedTransformations` | | Early transformations stage. These transformations run before most other options are processed. If the `regular` field is set in here, the `transformations` field is ignored. | <!-- Start of HubSpot Embed Code --> <script type="text/javascript" id="hs-script-loader" async defer src="//js.hs-scripts.com/5130874.js"></script> <!-- End of HubSpot Embed Code -->