The default capture mode defined by the environment.

Capture traffic using IPtables redirection.

No traffic capture.

Use the global default.

Do not upgrade the connection to http2.

Upgrade the connection to http2.

All listeners/routes/clusters in both sidecars and gateways.

Applies the patch to a cluster in a CDS output.

All protocols.

All listeners.

Gateway listener.

HTTP or HTTPS (with termination) / HTTP2/gRPC.

Inbound listener in sidecar.

Outbound listener in sidecar.

Any non-HTTP listener.

Applies the patch to the filter chain.

Http filter.

placeholder.

Network filter.

Gateway listener/route/cluster.

Applies the patch to the HTTP filter chain in the http connection manager, to modify an existing filter or add a new filter.

Insert after the named filter.

Insert before the named filter.

Insert first.

Insert last.

Applies the patch to the listener.

Applies the patch to the network filter chain, to modify an existing filter or add a new filter.

For maps this will either add to the map or replace the value for the key.

Insert operation on an array of named objects.

Insert operation on an array of named objects.

Overlay the value onto the element selected by the path using json merge semantics.

Remove the selected elements from their parent.

Applies the patch to the Route configuration (rds output) inside a HTTP connection manager.

Inbound listener/route/cluster in sidecar.

Outbound listener/route/cluster in sidecar.

Applies the patch to a virtual host inside a route configuration.

The least request load balancer uses an O(1) algorithm which selects two random healthy hosts and picks the host which has fewer active requests.

This option will forward the connection to the original IP address requested by the caller without doing any form of load balancing.

The random load balancer selects a random healthy host.

Round Robin policy.

Similar to the passthrough mode, except servers with this TLS mode do not require an associated VirtualService to map from the SNI value to service in the registry.

Secure connections to the upstream using mutual TLS by presenting client certificates for authentication.

The SNI string presented by the client will be used as the match criterion in a VirtualService TLS route to determine the destination service from the service registry.

Secure connections with standard TLS semantics.

Automatically choose the optimal TLS version.

TLS version 1.0.

TLS version 1.1.

TLS version 1.2.

TLS version 1.3.

Attempt to resolve the IP address by querying the ambient DNS, during request processing.

Signifies that the service is external to the mesh.

Signifies that the service is part of the mesh.

Assume that incoming connections have already been resolved (to a specific destination IP address).

Use the static IP addresses specified in endpoints (see below) as the backing instances associated with the service.

Do not setup a TLS connection to the upstream endpoint.

Secure connections to the upstream using mutual TLS by presenting client certificates for authentication.

Secure connections to the upstream using mutual TLS by presenting client certificates for authentication.

Originate a TLS connection to the upstream endpoint.

Connection pool settings for an upstream host.

Settings applicable to HTTP1.1/HTTP2/GRPC connections.

Settings common to both HTTP and TCP upstream connections.

TCP keepalive.

Describes the Cross-Origin Resource Sharing (CORS) policy, for a given service.

Destination indicates the network addressable service to which the request/connection will be sent after processing a routing rule.

Conditions specified in ClusterMatch must be met for the patch to be applied to a cluster.

Deprecated.

Changes to be made to various envoy config objects.

Match conditions for selecting an object to patch.

Deprecated.

Deprecated.

Conditions specified in a listener match must be met for the patch to be applied to a specific listener across all filter chains, or a specific filter chain inside the listener.

For listeners with multiple filter chains (e.g., inbound listeners on sidecars with permissive mTLS, gateway listeners with multiple SNI matches), the filter chain match can be used to select a specific filter chain to patch.

Conditions to match a specific filter within a filter chain.

Conditions to match a specific filter within another filter.

Patch specifies the JSON path in the generated proto and the content to merge/remove on the specific path.

Conditions specified in RouteConfigurationMatch must be met for the patch to be applied to a route configuration object or a specific virtual host within the route configuration.

Match a specific virtual host inside a route configuration.

Header manipulation rules.

HeaderOperations Describes the header manipulations to apply.

HTTPFaultInjection can be used to specify one or more faults to inject while forwarding http requests to the destination specified in a route.

Abort specification is used to prematurely abort a request with a pre-specified error code.

Delay specification is used to inject latency into the request forwarding path.

HttpMatchRequest specifies a set of criterion to be met in order for the rule to be applied to the HTTP request.

HTTPRedirect can be used to send a 301 redirect response to the caller, where the Authority/Host and the URI in the response can be swapped with the specified values.

Describes the retry policy to use when a HTTP request fails.

HTTPRewrite can be used to rewrite specific parts of a HTTP request before forwarding the request to the destination.

Describes match conditions and actions for routing HTTP/1.1, HTTP2, and gRPC traffic.

Each routing rule is associated with one or more service versions (see glossary in beginning of document).

IstioEgressListener specifies the properties of an outbound traffic listener on the sidecar proxy attached to a workload instance.

IstioIngressListener specifies the properties of an inbound traffic listener on the sidecar proxy attached to a workload instance.

L4 connection match attributes.

Load balancing policies to apply for a specific destination.

Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties.

Describes a HTTP cookie that will be used as the hash key for the Consistent Hash load balancer.

A Circuit breaker implementation that tracks the status of each individual host in the upstream service.

Percent specifies a percentage in the range of [0.0, 100.0].

Port describes the properties of a specific port of a service.

PortSelector specifies the number of a port to be used for matching or selection for final routing.

L4 routing rule weighted destination.

`Server` describes the properties of the proxy on a given load balancer port.

Endpoint defines a network address (IP or hostname) associated with the mesh service.

Describes how to match a given string in HTTP headers.

A subset of endpoints of a service.

Describes match conditions and actions for routing TCP traffic.

TLS connection match attributes.

Describes match conditions and actions for routing unterminated TLS traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS traffic arriving at port 443 of gateway called "mygateway" to internal services in the mesh based on the SNI value.

SSL/TLS related settings for upstream connections.

Traffic policies to apply for a specific destination, across all destination ports.

Traffic policies that apply to specific ports of the service.

WorkloadSelector specifies the criteria used to determine if the Gateway, Sidecar, or EnvoyFilter resource can be applied to a proxy.

CaptureMode describes how traffic to a listener is expected to be captured.

Policy for upgrading http1.1 connections to http2.

ApplyTo specifies where in the Envoy configuration, the given patch should be applied.

Index/position in the filter chain.

Operation denotes how the patch should be applied to the selected configuration.

PatchContext selects a class of configurations based on the traffic flow direction and workload type.

Standard load balancing algorithms that require no tuning.

TLS modes enforced by the proxy.

TLS protocol versions.

Location specifies whether the service is part of Istio mesh or outside the mesh.

Resolution determines how the proxy will resolve the IP addresses of the network endpoints associated with the service, so that it can route to one of them.

TLS connection mode.