Mixer Client

Map of attribute names to StringMatch type. Each map element specifies one condition to match.

Example:

clause: source.uid: exact: SOURCEUID request.httpmethod: exact: POST

List of JWT rules to valide.

If the request includes a JWT it must match one of the JWT listed here matched by the issuer. If validation is successfull the follow attributes are included in requests to the mixer:

request.auth.principal - The string of the issuer (`iss`) and
subject (`sub`) claims within a JWT concatenated with “/”
with a percent-encoded subject value

request.auth.audiences - This should reflect the audience
(`aud`) claim within matched JWT.

request.auth.presenter - The authorized presenter of the
credential. This value should reflect the optional Authorized
Presenter (`azp`) claim within a JWT

If no match is found the request is rejected with HTTP status code 401.

JWT validation is skipped if the user’s traffic request does not include a JWT.

REQUIRED. One or more services to map the listed EndUserAuthenticationPolicySpecs onto.

REQUIRED. One or more EndUserAuthenticationPolicySpecReference that should be mapped to the specified service(s).

REQUIRED. The short name of the EndUserAuthenticationPolicySpec. This is the resource name defined by the metadata name field.

Optional namespace of the EndUserAuthenticationPolicySpec. Defaults to the value of the metadata namespace field.

List of attributes that are generated when any of the HTTP patterns match. This list typically includes the “api.service” and “api.version” attributes.

List of HTTP patterns to match.

List of APIKey that describes how to extract an API-KEY from an HTTP request. The first API-Key match found in the list is used, i.e. ‘OR’ semantics.

The following default policies are used to generate the request.api_key attribute if no explicit APIKey is defined.

`query: key, `query: api_key`, and then `header: x-api-key`

REQUIRED. One or more services to map the listed HTTPAPISpec onto.

REQUIRED. One or more HTTPAPISpec references that should be mapped to the specified service(s). The aggregate collection of match conditions defined in the HTTPAPISpecs should not overlap.

List of attributes that are generated if the HTTP request matches the specified httpmethod and uritemplate. This typically includes the “api.operation” attribute.

HTTP request method to match against as defined by rfc7231. For example: GET, HEAD, POST, PUT, DELETE.

REQUIRED. The short name of the HTTPAPISpec. This is the resource name defined by the metadata name field.

Optional namespace of the HTTPAPISpec. Defaults to the encompassing HTTPAPISpecBinding’s metadata namespace field.

The transport config.

Map of control configuration indexed by destination.service. This is used to support per-service configuration for cases where a mixerclient serves multiple services.

Default destination service name if none was specified in the client request.

Default attributes to send to Mixer in both Check and Report. This typically includes “destination.ip” and “destination.uid” attributes.

Default attributes to forward to upstream. This typically includes the “source.ip” and “source.uid” attributes.

The short name of the service such as “foo”.

Optional namespace of the service. Defaults to value of metadata namespace field.

Domain suffix used to construct the service FQDN in implementations that support such specification.

The service FQDN.

Optional one or more labels that uniquely identify the service version.

Note: When used for a RouteRule destination, labels MUST be empty.

Identifies the principal that issued the JWT. See https://tools.ietf.org/html/rfc7519#section-4.1.1 Usually a URL or an email address.

Example: https://securetoken.google.com Example: 1234567-compute@developer.gserviceaccount.com

The list of JWT audiences. that are allowed to access. A JWT containing any of these audiences will be accepted.

The service name will be accepted if audiences is empty.

Example:

audiences:
- bookstore_android.apps.googleusercontent.com
  bookstore_web.apps.googleusercontent.com

URL of the provider’s public key set to validate signature of the JWT. See OpenID Discovery.

Optional if the key set document can either (a) be retrieved from OpenID Discovery of the issuer or (b) inferred from the email domain of the issuer (e.g. a Google service account).

Example: https://www.googleapis.com/oauth2/v1/certs

If true, forward the entire base64 encoded JWT in the HTTP request. If false, remove the JWT from the HTTP request and do not forward to the application.

Duration after which the cached public key should be expired. The system wide default is applied if no duration is explicitly specified.

Zero or more locations to search for JWT in an HTTP request.

This field is specific for Envoy proxy implementation. It is the cluster name in the Envoy config for the jwks_uri.

Specifies the behavior when the client is unable to connect to Mixer.

The quota name to charge

The quota amount to charge

If empty, match all request. If any of match is true, it is matched.

The list of quotas to charge.

A list of Quota rules.

REQUIRED. One or more services to map the listed QuotaSpec onto.

REQUIRED. One or more QuotaSpec references that should be mapped to the specified service(s). The aggregate collection of match conditions defined in the QuotaSpecs should not overlap.

REQUIRED. The short name of the QuotaSpec. This is the resource name defined by the metadata name field.

Optional namespace of the QuotaSpec. Defaults to the value of the metadata namespace field.

If true, do not call Mixer Check.

If true, do not call Mixer Report.

Send these attributes to Mixer in both Check and Report. This typically includes the “destination.service” attribute.

HTTP API specifications to generate API attributes.

Quota specifications to generate quota requirements.

End user authentication policy.

Specifies the behavior when the client is unable to connect to Mixer. This is the service-level policy. It overrides mesh-level policy.

The transport config.

Default attributes to send to Mixer in both Check and Report. This typically includes “destination.ip” and “destination.uid” attributes.

If set to true, disables mixer check calls.

If set to true, disables mixer check calls.

Quota specifications to generate quota requirements. It applies on the new TCP connections.

Specify report interval to send periodical reports for long TCP connections. If not specified, the interval is 10 seconds. This interval should not be less than 1 second, otherwise it will be reset to 1 second.

The flag to disable check cache.

The flag to disable quota cache.

The flag to disable report batch.

Specifies the behavior when the client is unable to connect to Mixer. This is the mesh level policy. The default value for policy is FAIL_OPEN.

Specify refresh interval to write mixer client statistics to Envoy share memory. If not specified, the interval is 10 seconds.

Name of the cluster that will forward check calls to a pool of mixer servers. Defaults to “mixer_server”. By using different names for checkCluster and reportCluster, it is possible to have one set of mixer servers handle check calls, while another set of mixer servers handle report calls.

NOTE: Any value other than the default “mixer_server” will require the Istio Grafana dashboards to be reconfigured to use the new name.

Name of the cluster that will forward report calls to a pool of mixer servers. Defaults to “mixer_server”. By using different names for checkCluster and reportCluster, it is possible to have one set of mixer servers handle check calls, while another set of mixer servers handle report calls.

NOTE: Any value other than the default “mixer_server” will require the Istio Grafana dashboards to be reconfigured to use the new name.

A map of attribute name to its value.