{
  "properties": {
    "spec": {
      "additionalProperties": false,
      "description": "Extend the functionality provided by the Istio proxy through WebAssembly or Lua filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/traffic_extension.html",
      "oneOf": [
        {
          "not": {
            "anyOf": [
              {
                "required": [
                  "wasm"
                ]
              },
              {
                "required": [
                  "lua"
                ]
              }
            ]
          }
        },
        {
          "required": [
            "wasm"
          ]
        },
        {
          "required": [
            "lua"
          ]
        }
      ],
      "properties": {
        "lua": {
          "additionalProperties": false,
          "description": "Lua filter configuration.",
          "properties": {
            "inlineCode": {
              "description": "The inline Lua code to be executed.",
              "maxLength": 65536,
              "minLength": 1,
              "type": "string"
            }
          },
          "required": [
            "inlineCode"
          ],
          "type": [
            "object",
            "null"
          ]
        },
        "match": {
          "description": "Specifies the criteria to determine which traffic is passed to TrafficExtension.",
          "items": {
            "additionalProperties": false,
            "properties": {
              "mode": {
                "description": "Criteria for selecting traffic by their direction.\n\nValid Options: CLIENT, SERVER, CLIENT_AND_SERVER",
                "enum": [
                  "UNDEFINED",
                  "CLIENT",
                  "SERVER",
                  "CLIENT_AND_SERVER"
                ],
                "type": [
                  "string",
                  "null"
                ]
              },
              "ports": {
                "description": "Criteria for selecting traffic by their destination port.",
                "items": {
                  "additionalProperties": false,
                  "properties": {
                    "number": {
                      "maximum": 65535,
                      "minimum": 1,
                      "type": "integer"
                    }
                  },
                  "required": [
                    "number"
                  ],
                  "type": "object"
                },
                "type": [
                  "array",
                  "null"
                ],
                "x-kubernetes-list-map-keys": [
                  "number"
                ],
                "x-kubernetes-list-type": "map"
              }
            },
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "phase": {
          "description": "Determines where in the filter chain this `TrafficExtension` is to be injected.\n\nValid Options: AUTHN, AUTHZ, STATS",
          "enum": [
            "UNSPECIFIED",
            "AUTHN",
            "AUTHZ",
            "STATS"
          ],
          "type": [
            "string",
            "null"
          ]
        },
        "priority": {
          "description": "Determines ordering of `TrafficExtensions` in the same `phase`.",
          "format": "int32",
          "nullable": true,
          "type": [
            "integer",
            "null"
          ]
        },
        "selector": {
          "additionalProperties": false,
          "description": "Optional.",
          "properties": {
            "matchLabels": {
              "additionalProperties": {
                "maxLength": 63,
                "type": "string",
                "x-kubernetes-validations": [
                  {
                    "message": "wildcard not allowed in label value match",
                    "rule": "!self.contains(\"*\")"
                  }
                ]
              },
              "description": "One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.",
              "maxProperties": 4096,
              "type": [
                "object",
                "null"
              ],
              "x-kubernetes-validations": [
                {
                  "message": "wildcard not allowed in label key match",
                  "rule": "self.all(key, !key.contains(\"*\"))"
                },
                {
                  "message": "key must not be empty",
                  "rule": "self.all(key, key.size() != 0)"
                }
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "targetRefs": {
          "description": "Optional.",
          "items": {
            "additionalProperties": false,
            "properties": {
              "group": {
                "description": "group is the group of the target resource.",
                "maxLength": 253,
                "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
                "type": [
                  "string",
                  "null"
                ]
              },
              "kind": {
                "description": "kind is kind of the target resource.",
                "maxLength": 63,
                "minLength": 1,
                "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$",
                "type": "string"
              },
              "name": {
                "description": "name is the name of the target resource.",
                "maxLength": 253,
                "minLength": 1,
                "type": "string"
              },
              "namespace": {
                "description": "namespace is the namespace of the referent.",
                "type": [
                  "string",
                  "null"
                ],
                "x-kubernetes-validations": [
                  {
                    "message": "cross namespace referencing is not currently supported",
                    "rule": "self.size() == 0"
                  }
                ]
              }
            },
            "required": [
              "kind",
              "name"
            ],
            "type": "object"
          },
          "maxItems": 16,
          "type": [
            "array",
            "null"
          ]
        },
        "wasm": {
          "additionalProperties": false,
          "description": "WebAssembly filter configuration.",
          "properties": {
            "failStrategy": {
              "description": "Specifies the failure behavior for the plugin due to fatal errors.\n\nValid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD",
              "enum": [
                "FAIL_CLOSE",
                "FAIL_OPEN",
                "FAIL_RELOAD"
              ],
              "type": [
                "string",
                "null"
              ]
            },
            "imagePullPolicy": {
              "description": "The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`.\n\nValid Options: IfNotPresent, Always",
              "enum": [
                "UNSPECIFIED_POLICY",
                "IfNotPresent",
                "Always"
              ],
              "type": [
                "string",
                "null"
              ]
            },
            "imagePullSecret": {
              "description": "Credentials to use for OCI image pulling.",
              "maxLength": 253,
              "minLength": 1,
              "type": [
                "string",
                "null"
              ]
            },
            "pluginConfig": {
              "description": "The configuration that will be passed on to the plugin.",
              "type": [
                "object",
                "null"
              ],
              "x-kubernetes-preserve-unknown-fields": true
            },
            "pluginName": {
              "description": "The plugin name to be used in the Envoy configuration (used to be called `rootID`).",
              "maxLength": 256,
              "minLength": 1,
              "type": [
                "string",
                "null"
              ]
            },
            "sha256": {
              "description": "SHA256 checksum that will be used to verify Wasm module or OCI container.",
              "pattern": "(^$|^[a-f0-9]{64}$)",
              "type": [
                "string",
                "null"
              ]
            },
            "type": {
              "description": "Specifies the type of Wasm Extension to be used.\n\nValid Options: HTTP, NETWORK",
              "enum": [
                "UNSPECIFIED_PLUGIN_TYPE",
                "HTTP",
                "NETWORK"
              ],
              "type": [
                "string",
                "null"
              ]
            },
            "url": {
              "description": "URL of a Wasm module or OCI container.",
              "minLength": 1,
              "type": "string",
              "x-kubernetes-validations": [
                {
                  "message": "url must have schema one of [http, https, file, oci]",
                  "rule": "isURL(self) ? (url(self).getScheme() in [\"\", \"http\", \"https\", \"file\", \"oci\"]) : (isURL(\"http://\" + self) \u0026\u0026\nurl(\"http://\" + self).getScheme() in [\"\", \"http\", \"https\", \"file\", \"oci\"])"
                }
              ]
            },
            "verificationKey": {
              "type": [
                "string",
                "null"
              ]
            },
            "vmConfig": {
              "additionalProperties": false,
              "description": "Configuration for a Wasm VM.",
              "properties": {
                "env": {
                  "description": "Specifies environment variables to be injected to this VM.",
                  "items": {
                    "additionalProperties": false,
                    "properties": {
                      "name": {
                        "description": "Name of the environment variable.",
                        "maxLength": 256,
                        "minLength": 1,
                        "type": "string"
                      },
                      "value": {
                        "description": "Value for the environment variable.",
                        "maxLength": 2048,
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "valueFrom": {
                        "description": "Source for the environment variable's value.\n\nValid Options: INLINE, HOST",
                        "enum": [
                          "INLINE",
                          "HOST"
                        ],
                        "type": [
                          "string",
                          "null"
                        ]
                      }
                    },
                    "required": [
                      "name"
                    ],
                    "type": "object",
                    "x-kubernetes-validations": [
                      {
                        "message": "value may only be set when valueFrom is INLINE",
                        "rule": "(has(self.valueFrom) ? self.valueFrom : \"\") != \"HOST\" || !has(self.value)"
                      }
                    ]
                  },
                  "maxItems": 256,
                  "type": [
                    "array",
                    "null"
                  ],
                  "x-kubernetes-list-map-keys": [
                    "name"
                  ],
                  "x-kubernetes-list-type": "map"
                }
              },
              "type": [
                "object",
                "null"
              ]
            }
          },
          "required": [
            "url"
          ],
          "type": [
            "object",
            "null"
          ]
        }
      },
      "type": "object",
      "x-kubernetes-validations": [
        {
          "message": "only one of targetRefs or selector can be set",
          "rule": "(has(self.selector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) \u003c= 1"
        },
        {
          "message": "exactly one of wasm or lua must be set",
          "rule": "has(self.wasm) != has(self.lua)"
        }
      ]
    },
    "status": {
      "additionalProperties": false,
      "properties": {
        "conditions": {
          "description": "Current service state of the resource.",
          "items": {
            "additionalProperties": false,
            "properties": {
              "lastProbeTime": {
                "description": "Last time we probed the condition.",
                "format": "date-time",
                "type": [
                  "string",
                  "null"
                ]
              },
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.",
                "format": "date-time",
                "type": [
                  "string",
                  "null"
                ]
              },
              "message": {
                "description": "Human-readable message indicating details about last transition.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "observedGeneration": {
                "description": "Resource Generation to which the Condition refers.",
                "oneOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "integer"
                  },
                  {
                    "type": "null"
                  }
                ],
                "x-kubernetes-int-or-string": true
              },
              "reason": {
                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "status": {
                "description": "Status is the status of the condition.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "type": {
                "description": "Type is the type of the condition.",
                "type": [
                  "string",
                  "null"
                ]
              }
            },
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "observedGeneration": {
          "oneOf": [
            {
              "type": "string"
            },
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ],
          "x-kubernetes-int-or-string": true
        },
        "validationMessages": {
          "description": "Includes any errors or warnings detected by Istio's analyzers.",
          "items": {
            "additionalProperties": false,
            "properties": {
              "documentationUrl": {
                "description": "A url pointing to the Istio documentation for this specific error type.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "level": {
                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
                "enum": [
                  "UNKNOWN",
                  "ERROR",
                  "WARNING",
                  "INFO"
                ],
                "type": [
                  "string",
                  "null"
                ]
              },
              "type": {
                "additionalProperties": false,
                "properties": {
                  "code": {
                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "name": {
                    "description": "A human-readable name for the message type.",
                    "type": [
                      "string",
                      "null"
                    ]
                  }
                },
                "type": [
                  "object",
                  "null"
                ]
              }
            },
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ],
      "x-kubernetes-preserve-unknown-fields": true
    }
  },
  "required": [
    "spec"
  ],
  "type": "object"
}