{"uuid": "ef0c5f0e-e1d3-464f-a997-74afbb1df7b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-44487", "type": "seen", "source": "https://gist.github.com/danzori/bfa442781ea586adfdad3fa9547dbb7f", "content": "{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"$ref\": \"#/definitions/Bootstrap\",\n  \"definitions\": {\n    \"Bootstrap\": {\n      \"properties\": {\n        \"node\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Node\",\n          \"additionalProperties\": false,\n          \"description\": \"Node identity to present to the management server and for instance identification purposes (e.g. in generated headers).\"\n        },\n        \"node_context_params\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"A list of :ref:`Node ` field names that will be included in the context parameters of the effective ``xdstp://`` URL that is sent in a discovery request when resource locators are used for LDS/CDS. Any non-string field will have its JSON encoding set as the context parameter value, with the exception of metadata, which will be flattened (see example below). The supported field names are: - ``cluster`` - ``id`` - ``locality.region`` - ``locality.sub_zone`` - ``locality.zone`` - ``metadata`` - ``user_agent_build_version.metadata`` - ``user_agent_build_version.version`` - ``user_agent_name`` - ``user_agent_version`` The node context parameters act as a base layer dictionary for the context parameters (i.e. more specific resource specific context parameters will override). Field names will be prefixed with ````\\\"udpa.node.\\\"```` when included in context parameters. For example, if node_context_params is ``[\\\"user_agent_name\\\", \\\"metadata\\\"]``, the implied context parameters might be::   node.user_agent_name: \\\"envoy\\\"   node.metadata.foo: \\\"{\\\\\\\"bar\\\\\\\": \\\\\\\"baz\\\\\\\"}\\\"   node.metadata.some: \\\"42\\\"   node.metadata.thing: \\\"\\\\\\\"thing\\\\\\\"\\\" [#not-implemented-hide:]\"\n        },\n        \"static_resources\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Bootstrap.StaticResources\",\n          \"additionalProperties\": false,\n          \"description\": \"Statically specified resources.\"\n        },\n        \"dynamic_resources\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Bootstrap.DynamicResources\",\n          \"additionalProperties\": false,\n          \"description\": \"xDS configuration sources.\"\n        },\n        \"cluster_manager\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.ClusterManager\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the cluster manager which owns all upstream clusters within the server.\"\n        },\n        \"hds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ApiConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Health discovery service config option. (:ref:`core.ApiConfigSource `)\"\n        },\n        \"flags_path\": {\n          \"type\": \"string\",\n          \"description\": \"Optional file system path to search for startup flag files.\"\n        },\n        \"stats_sinks\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.metrics.v3.StatsSink\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Optional set of stats sinks.\"\n        },\n        \"deferred_stat_options\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Bootstrap.DeferredStatOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Options to control behaviors of deferred creation compatible stats.\"\n        },\n        \"stats_config\": {\n          \"$ref\": \"#/definitions/envoy.config.metrics.v3.StatsConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for internal processing of stats.\"\n        },\n        \"stats_flush_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Optional duration between flushes to configured stats sinks. For performance reasons Envoy latches counters and only flushes counters and gauges at a periodic interval. If not specified the default is ``5000ms`` (``5`` seconds). Only one of ``stats_flush_interval`` or ``stats_flush_on_admin`` can be set. Duration must be at least ``1ms`` and at most ``5 min``.\",\n          \"format\": \"regex\"\n        },\n        \"stats_flush_on_admin\": {\n          \"type\": \"boolean\",\n          \"description\": \"Flush stats to sinks only when queried for on the admin interface. If set, a flush timer is not created. Only one of ``stats_flush_on_admin`` or ``stats_flush_interval`` can be set.\"\n        },\n        \"stats_eviction_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Optional duration to perform metric eviction. At every interval, during the stats flush the unused metrics are removed from the worker caches and the used metrics are marked as unused. Must be a multiple of the ``stats_flush_interval``.\",\n          \"format\": \"regex\"\n        },\n        \"watchdog\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Watchdog\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional watchdog configuration. This is for a single watchdog configuration for the entire system. Deprecated in favor of ``watchdogs`` which has finer granularity.\"\n        },\n        \"watchdogs\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Watchdogs\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional watchdogs configuration. This is used for specifying different watchdogs for the different subsystems. [#extension-category: envoy.guarddog_actions]\"\n        },\n        \"tracing\": {\n          \"$ref\": \"#/definitions/envoy.config.trace.v3.Tracing\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for an external tracing provider. .. attention::  This field has been deprecated in favor of :ref:`HttpConnectionManager.Tracing.provider  `.\"\n        },\n        \"layered_runtime\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.LayeredRuntime\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the runtime configuration provider. If not specified, a \u201cnull\u201d provider will be used which will result in all defaults being used.\"\n        },\n        \"admin\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Admin\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the local administration HTTP server.\"\n        },\n        \"overload_manager\": {\n          \"$ref\": \"#/definitions/envoy.config.overload.v3.OverloadManager\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional overload manager configuration.\"\n        },\n        \"enable_dispatcher_stats\": {\n          \"type\": \"boolean\",\n          \"description\": \"Enable :ref:`stats for event dispatcher `. Defaults to ``false``. .. note::   This records a value for each iteration of the event loop on every thread. This   should normally be minimal overhead, but when using   :ref:`statsd `, it will send each observed value   over the wire individually because the statsd protocol doesn't have any way to represent a   histogram summary. Be aware that this can be a very large volume of data.\"\n        },\n        \"header_prefix\": {\n          \"type\": \"string\",\n          \"description\": \"Optional string which will be used in lieu of ``x-envoy`` in prefixing headers. For example, if this string is present and set to ``X-Foo``, then ``x-envoy-retry-on`` will be transformed into ``x-foo-retry-on`` etc. .. note::   This applies to the headers Envoy will generate, the headers Envoy will sanitize, and the   headers Envoy will trust for core code and core extensions only. Be VERY careful making   changes to this string, especially in multi-layer Envoy deployments or deployments using   extensions which are not upstream.\"\n        },\n        \"stats_server_version_override\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Optional proxy version which will be used to set the value of :ref:`server.version statistic ` if specified. Envoy will not process this value, it will be sent as is to :ref:`stats sinks `.\"\n        },\n        \"use_tcp_for_dns_lookups\": {\n          \"type\": \"boolean\",\n          \"description\": \"Always use ``TCP`` queries instead of ``UDP`` queries for DNS lookups. This may be overridden on a per-cluster basis in ``cds_config``, when :ref:`dns_resolvers ` and :ref:`use_tcp_for_dns_lookups ` are specified. This field is deprecated in favor of ``dns_resolution_config`` which aggregates all of the DNS resolver configuration in a single message.\"\n        },\n        \"dns_resolution_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DnsResolutionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"DNS resolution configuration which includes the underlying DNS resolver addresses and options. This may be overridden on a per-cluster basis in ``cds_config``, when :ref:`dns_resolution_config ` is specified. This field is deprecated in favor of :ref:`typed_dns_resolver_config `.\"\n        },\n        \"typed_dns_resolver_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"DNS resolver type configuration extension. This extension can be used to configure ``c-ares``, ``apple``, or any other DNS resolver types and the related parameters. For example, an object of :ref:`CaresDnsResolverConfig ` can be packed into this ``typed_dns_resolver_config``. This configuration replaces the :ref:`dns_resolution_config ` configuration. During the transition period when both ``dns_resolution_config`` and ``typed_dns_resolver_config`` exist, when ``typed_dns_resolver_config`` is in place, Envoy will use it and ignore ``dns_resolution_config``. When ``typed_dns_resolver_config`` is missing, the default behavior is in place. [#extension-category: envoy.network.dns_resolver]\"\n        },\n        \"bootstrap_extensions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies optional bootstrap extensions to be instantiated at startup time. Each item contains extension specific configuration. [#extension-category: envoy.bootstrap]\"\n        },\n        \"fatal_actions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.FatalAction\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies optional extensions instantiated at startup time and invoked during crash time on the request that caused the crash.\"\n        },\n        \"config_sources\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration sources that will participate in ``xdstp://`` URL authority resolution. The algorithm is as follows: 1. The authority field is taken from the ``xdstp://`` URL, call    this ``resource_authority``. 2. ``resource_authority`` is compared against the authorities in any peer    ``ConfigSource``. The peer ``ConfigSource`` is the configuration source    message which would have been used unconditionally for resolution    with opaque resource names. If there is a match with an authority, the    peer ``ConfigSource`` message is used. 3. ``resource_authority`` is compared sequentially with the authorities in    each configuration source in ``config_sources``. The first ``ConfigSource``    to match wins. 4. As a fallback, if no configuration source matches, then    ``default_config_source`` is used. 5. If ``default_config_source`` is not specified, resolution fails. [#not-implemented-hide:]\"\n        },\n        \"default_config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Default configuration source for ``xdstp://`` URLs if all other resolution fails. [#not-implemented-hide:]\"\n        },\n        \"default_socket_interface\": {\n          \"type\": \"string\",\n          \"description\": \"Optional overriding of default socket interface. The value must be the name of one of the socket interface factories initialized through a bootstrap extension\"\n        },\n        \"certificate_provider_instances\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"Global map of CertificateProvider instances. These instances are referred to by name in the :ref:`CommonTlsContext.CertificateProviderInstance.instance_name ` field. [#not-implemented-hide:]\"\n        },\n        \"inline_headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.CustomInlineHeader\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of headers that need to be registered as inline header. This configuration allows users to customize the inline headers on-demand at Envoy startup without modifying Envoy's source code. .. note::   The ``set-cookie`` header cannot be registered as inline header.\"\n        },\n        \"perf_tracing_file_path\": {\n          \"type\": \"string\",\n          \"description\": \"Optional path to a file with performance tracing data created by ``Perfetto`` SDK in binary ProtoBuf format. The default value is ``envoy.pftrace``.\"\n        },\n        \"default_regex_engine\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional overriding of default regex engine. If the value is not specified, ``Google RE2`` will be used by default. [#extension-category: envoy.regex_engines]\"\n        },\n        \"xds_delegate_extension\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional XdsResourcesDelegate configuration, which allows plugging custom logic into both fetch and load events during xDS processing. If a value is not specified, no ``XdsResourcesDelegate`` will be used. TODO(abeyad): Add public-facing documentation. [#not-implemented-hide:]\"\n        },\n        \"xds_config_tracker_extension\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional XdsConfigTracker configuration, which allows tracking xDS responses in external components, e.g., external tracer or monitor. It provides the process point when receive, ingest, or fail to process xDS resources and messages. If a value is not specified, no ``XdsConfigTracker`` will be used. .. note::    There are no in-repo extensions currently, and the :repo:`XdsConfigTracker `    interface should be implemented before using.    See :repo:`xds_config_tracker_integration_test `    for an example usage of the interface.\"\n        },\n        \"listener_manager\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] This controls the type of listener manager configured for Envoy. Currently Envoy only supports ``ListenerManager`` for this field and Envoy Mobile supports ``ApiListenerManager``.\"\n        },\n        \"application_log_config\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Bootstrap.ApplicationLogConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional application log configuration.\"\n        },\n        \"grpc_async_client_manager_config\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Bootstrap.GrpcAsyncClientManagerConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional gRPC async client manager config.\"\n        },\n        \"memory_allocator_manager\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.MemoryAllocatorManager\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration for memory allocation manager. Memory releasing is only supported for `tcmalloc allocator `_.\"\n        },\n        \"enable_worker_cpu_affinity\": {\n          \"type\": \"boolean\",\n          \"description\": \"When enabled, Envoy pins each worker thread to a distinct CPU from the process affinity mask, worker ``i`` to the ``i-th`` CPU in ascending order. This improves CPU cache and ``NUMA`` locality for high concurrency deployments on bare metal. It is available on Linux only and is ignored on other platforms. Pinning requires a worker count no greater than the number of CPUs in the process affinity mask. When the worker count exceeds the available CPUs no worker is pinned. Pinning is applied once when the workers start, so a later change to the process affinity mask does not re-pin. Defaults to ``false``.\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Bootstrap]\\n This proto is supplied via the :option:`-c` CLI flag and acts as the root\\n of the Envoy v3 configuration. See the :ref:`v3 configuration overview\\n ` for more detail.\",\n      \"description\": \"[#protodoc-title: Bootstrap] This proto is supplied via the :option:`-c` CLI flag and acts as the root of the Envoy v3 configuration. See the :ref:`v3 configuration overview ` for more detail.  Bootstrap :ref:`configuration overview `. [#next-free-field: 44]\"\n    },\n    \"envoy.config.accesslog.v3.AccessLog\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the access log extension configuration.\"\n        },\n        \"filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLogFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Filter which is used to determine if the access log needs to be written.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Common access log types]\",\n      \"description\": \"[#protodoc-title: Common access log types]\"\n    },\n    \"envoy.config.accesslog.v3.AccessLogFilter\": {\n      \"properties\": {\n        \"status_code_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.StatusCodeFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Status code filter.\"\n        },\n        \"duration_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.DurationFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Duration filter.\"\n        },\n        \"not_health_check_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.NotHealthCheckFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Not health check filter.\"\n        },\n        \"traceable_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.TraceableFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Traceable filter.\"\n        },\n        \"runtime_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.RuntimeFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Runtime filter.\"\n        },\n        \"and_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AndFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"And filter.\"\n        },\n        \"or_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.OrFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Or filter.\"\n        },\n        \"header_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.HeaderFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Header filter.\"\n        },\n        \"response_flag_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.ResponseFlagFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Response flag filter.\"\n        },\n        \"grpc_status_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.GrpcStatusFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"gRPC status filter.\"\n        },\n        \"extension_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.ExtensionFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Extension filter. [#extension-category: envoy.access_loggers.extension_filters]\"\n        },\n        \"metadata_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.MetadataFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Metadata Filter\"\n        },\n        \"log_type_filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.LogTypeFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Log Type Filter\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Access Log Filter\",\n      \"description\": \"[#next-free-field: 14]\"\n    },\n    \"envoy.config.accesslog.v3.AndFilter\": {\n      \"properties\": {\n        \"filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLogFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"And Filter\",\n      \"description\": \"Performs a logical \u201cand\u201d operation on the result of each filter in filters. Filters are evaluated sequentially and if one of them returns false, the filter returns false immediately.\"\n    },\n    \"envoy.config.accesslog.v3.ComparisonFilter\": {\n      \"properties\": {\n        \"op\": {\n          \"enum\": [\n            \"EQ\",\n            0,\n            \"GE\",\n            1,\n            \"LE\",\n            2,\n            \"NE\",\n            3\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Op\"\n        },\n        \"value\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeUInt32\",\n          \"additionalProperties\": false,\n          \"description\": \"Value to compare against.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Comparison Filter\",\n      \"description\": \"Filter on an integer comparison.\"\n    },\n    \"envoy.config.accesslog.v3.DurationFilter\": {\n      \"properties\": {\n        \"comparison\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.ComparisonFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Comparison.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Duration Filter\",\n      \"description\": \"Filters based on the duration of the request or stream, in milliseconds. For end of stream access logs, the total duration of the stream will be used. For :ref:`periodic access logs`, the duration of the stream at the time of log recording will be used.\"\n    },\n    \"envoy.config.accesslog.v3.ExtensionFilter\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the filter implementation to instantiate. The name must match a statically registered filter.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Extension Filter\",\n      \"description\": \"Extension filter is statically registered at runtime.\"\n    },\n    \"envoy.config.accesslog.v3.GrpcStatusFilter\": {\n      \"properties\": {\n        \"statuses\": {\n          \"items\": {\n            \"enum\": [\n              \"OK\",\n              0,\n              \"CANCELED\",\n              1,\n              \"UNKNOWN\",\n              2,\n              \"INVALID_ARGUMENT\",\n              3,\n              \"DEADLINE_EXCEEDED\",\n              4,\n              \"NOT_FOUND\",\n              5,\n              \"ALREADY_EXISTS\",\n              6,\n              \"PERMISSION_DENIED\",\n              7,\n              \"RESOURCE_EXHAUSTED\",\n              8,\n              \"FAILED_PRECONDITION\",\n              9,\n              \"ABORTED\",\n              10,\n              \"OUT_OF_RANGE\",\n              11,\n              \"UNIMPLEMENTED\",\n              12,\n              \"INTERNAL\",\n              13,\n              \"UNAVAILABLE\",\n              14,\n              \"DATA_LOSS\",\n              15,\n              \"UNAUTHENTICATED\",\n              16\n            ]\n          },\n          \"type\": \"array\",\n          \"title\": \"Status\"\n        },\n        \"exclude\": {\n          \"type\": \"boolean\",\n          \"description\": \"If included and set to true, the filter will instead block all responses with a gRPC status or inferred gRPC status enumerated in statuses, and allow all other responses.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Grpc Status Filter\",\n      \"description\": \"Filters gRPC requests based on their response status. If a gRPC status is not provided, the filter will infer the status from the HTTP status code.\"\n    },\n    \"envoy.config.accesslog.v3.HeaderFilter\": {\n      \"properties\": {\n        \"header\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Only requests with a header which matches the specified HeaderMatcher will pass the filter check.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Filter\",\n      \"description\": \"Filters requests based on the presence or value of a request header.\"\n    },\n    \"envoy.config.accesslog.v3.LogTypeFilter\": {\n      \"properties\": {\n        \"types\": {\n          \"items\": {\n            \"enum\": [\n              \"NotSet\",\n              0,\n              \"TcpUpstreamConnected\",\n              1,\n              \"TcpPeriodic\",\n              2,\n              \"TcpConnectionStart\",\n              14,\n              \"TcpConnectionEnd\",\n              3,\n              \"DownstreamStart\",\n              4,\n              \"DownstreamPeriodic\",\n              5,\n              \"DownstreamEnd\",\n              6,\n              \"UpstreamPoolReady\",\n              7,\n              \"UpstreamPeriodic\",\n              8,\n              \"UpstreamEnd\",\n              9,\n              \"DownstreamTunnelSuccessfullyEstablished\",\n              10,\n              \"UdpTunnelUpstreamConnected\",\n              11,\n              \"UdpPeriodic\",\n              12,\n              \"UdpSessionEnd\",\n              13\n            ]\n          },\n          \"type\": \"array\",\n          \"title\": \"[#protodoc-title: gRPC access logs]\\n Envoy access logs describe incoming interaction with Envoy over a fixed\\n period of time, and typically cover a single request/response exchange,\\n (e.g. HTTP), stream (e.g. over HTTP/gRPC), or proxied connection (e.g. TCP).\\n Access logs contain fields defined in protocol-specific protobuf messages.\\n\\n Except where explicitly declared otherwise, all fields describe\\n *downstream* interaction between Envoy and a connected client.\\n Fields describing *upstream* interaction will explicitly include ``upstream``\\n in their name.\",\n          \"description\": \"[#protodoc-title: gRPC access logs] Envoy access logs describe incoming interaction with Envoy over a fixed period of time, and typically cover a single request/response exchange, (e.g. HTTP), stream (e.g. over HTTP/gRPC), or proxied connection (e.g. TCP). Access logs contain fields defined in protocol-specific protobuf messages. Except where explicitly declared otherwise, all fields describe *downstream* interaction between Envoy and a connected client. Fields describing *upstream* interaction will explicitly include ``upstream`` in their name.\"\n        },\n        \"exclude\": {\n          \"type\": \"boolean\",\n          \"description\": \"If this field is set to true, the filter will instead block all records with a access log type in types field, and allow all other records.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Log Type Filter\",\n      \"description\": \"Filters based on access log type.\"\n    },\n    \"envoy.config.accesslog.v3.MetadataFilter\": {\n      \"properties\": {\n        \"matcher\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.MetadataMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Matcher to check metadata for specified value. For example, to match on the access_log_hint metadata, set the filter to \\\"envoy.common\\\" and the path to \\\"access_log_hint\\\", and the value to \\\"true\\\".\"\n        },\n        \"match_if_key_not_found\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Default result if the key does not exist in dynamic metadata: if unset or true, then log; if false, then don't log.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Metadata Filter\",\n      \"description\": \"Filters based on matching dynamic metadata. If the matcher path and key correspond to an existing key in dynamic metadata, the request is logged only if the matcher value is equal to the metadata value. If the matcher path and key *do not* correspond to an existing key in dynamic metadata, the request is logged only if match_if_key_not_found is \\\"true\\\" or unset.\"\n    },\n    \"envoy.config.accesslog.v3.NotHealthCheckFilter\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Not Health Check Filter\",\n      \"description\": \"Filters for requests that are not health check requests. A health check request is marked by the health check filter.\"\n    },\n    \"envoy.config.accesslog.v3.OrFilter\": {\n      \"properties\": {\n        \"filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLogFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Or Filter\",\n      \"description\": \"Performs a logical \u201cor\u201d operation on the result of each individual filter. Filters are evaluated sequentially and if one of them returns true, the filter returns true immediately.\"\n    },\n    \"envoy.config.accesslog.v3.ResponseFlagFilter\": {\n      \"properties\": {\n        \"flags\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Only responses with the any of the flags listed in this field will be logged. This field is optional. If it is not specified, then any response flag will pass the filter check.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Response Flag Filter\",\n      \"description\": \"Filters requests that received responses with an Envoy response flag set. A list of the response flags can be found in the access log formatter :ref:`documentation`.\"\n    },\n    \"envoy.config.accesslog.v3.RuntimeFilter\": {\n      \"properties\": {\n        \"runtime_key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Specifies a key used to look up a custom sampling rate from the runtime configuration. If a value is found for this key, it will override the default sampling rate specified in ``percent_sampled``.\"\n        },\n        \"percent_sampled\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Defines the default sampling percentage when no runtime override is present. If not specified, the default is **0%** (with a denominator of 100).\"\n        },\n        \"use_independent_randomness\": {\n          \"type\": \"boolean\",\n          \"description\": \"Controls how sampling decisions are made. - Default behavior (``false``):   * Uses the :ref:`x-request-id` as a consistent sampling pivot.   * When :ref:`x-request-id` is present, sampling will be consistent     across multiple hosts based on both the ``runtime_key`` and     :ref:`x-request-id`.   * Useful for tracking related requests across a distributed system. - When set to ``true`` or :ref:`x-request-id` is missing:   * Sampling decisions are made randomly based only on the ``runtime_key``.   * Useful in complex filter configurations (like nested     :ref:`AndFilter`/     :ref:`OrFilter` blocks) where independent probability     calculations are desired.   * Can be used to implement logging kill switches with predictable probability distributions.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Runtime Filter\",\n      \"description\": \"Filters requests based on runtime-configurable sampling rates.\"\n    },\n    \"envoy.config.accesslog.v3.StatusCodeFilter\": {\n      \"properties\": {\n        \"comparison\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.ComparisonFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Comparison.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Status Code Filter\",\n      \"description\": \"Filters on HTTP response/status code.\"\n    },\n    \"envoy.config.accesslog.v3.TraceableFilter\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Traceable Filter\",\n      \"description\": \"Filters for requests that are traceable. See the tracing overview for more information on how a request becomes traceable.\"\n    },\n    \"envoy.config.bootstrap.v3.Admin\": {\n      \"properties\": {\n        \"access_log\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLog\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration for :ref:`access logs ` emitted by the administration server.\"\n        },\n        \"access_log_path\": {\n          \"type\": \"string\",\n          \"description\": \"The path to write the access log for the administration server. If no access log is desired specify ``/dev/null``. This is only required if :ref:`address ` is set. Deprecated in favor of ``access_log`` which offers more options.\"\n        },\n        \"profile_path\": {\n          \"type\": \"string\",\n          \"description\": \"The CPU profiler output path for the administration server. If no profile path is specified, the default is ``/var/log/envoy/envoy.prof``.\"\n        },\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Address\",\n          \"additionalProperties\": false,\n          \"description\": \"The TCP address that the administration server will listen on. If not specified, Envoy will not start an administration server.\"\n        },\n        \"socket_options\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Additional socket options that may not be present in Envoy source code or precompiled binaries.\"\n        },\n        \"ignore_global_conn_limit\": {\n          \"type\": \"boolean\",\n          \"description\": \"Indicates whether :ref:`global_downstream_max_connections ` should apply to the admin interface or not.\"\n        },\n        \"allow_paths\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"List of admin paths that are accessible. If not specified, all admin endpoints are accessible. Matchers are evaluated against the request path. For endpoints commonly queried with parameters (for example ``/stats?format=...``), prefer ``prefix`` matchers. When specified, only paths in this list will be accessible, all others will return ``HTTP 403 Forbidden``. Example: .. code-block:: yaml   allow_paths:   - prefix: /stats   - prefix: /config_dump   - exact: /ready   - prefix: /healthcheck\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Admin\",\n      \"description\": \"Administration interface :ref:`operations documentation `. [#next-free-field: 8]\"\n    },\n    \"envoy.config.bootstrap.v3.Bootstrap.ApplicationLogConfig\": {\n      \"properties\": {\n        \"log_format\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Bootstrap.ApplicationLogConfig.LogFormat\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional field to set the application logs format. If this field is set, it will override the default log format. Setting both this field and :option:`--log-format` command line option is not allowed, and will cause a bootstrap error.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Application Log Config\"\n    },\n    \"envoy.config.bootstrap.v3.Bootstrap.ApplicationLogConfig.LogFormat\": {\n      \"properties\": {\n        \"json_format\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Flush application logs in JSON format. The configured JSON struct can support all the format flags specified in the :option:`--log-format` command line options section, except for the ``%v`` and ``%_`` flags.\"\n        },\n        \"text_format\": {\n          \"type\": \"string\",\n          \"description\": \"Flush application log in a format defined by a string. The text format can support all the format flags specified in the :option:`--log-format` command line option section.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Log Format\"\n    },\n    \"envoy.config.bootstrap.v3.Bootstrap.DeferredStatOptions\": {\n      \"properties\": {\n        \"enable_deferred_creation_stats\": {\n          \"type\": \"boolean\",\n          \"description\": \"When the flag is enabled, Envoy will lazily initialize a subset of the stats (see below). This will save memory and CPU cycles when creating the objects that own these stats, if those stats are never referenced throughout the lifetime of the process. However, it will incur additional memory overhead for these objects, and a small increase of CPU usage when at least one of the stats is updated for the first time. Groups of stats that will be lazily initialized: - Cluster traffic stats: a subgroup of the :ref:`cluster statistics `   that are used when requests are routed to the cluster.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Deferred Stat Options\"\n    },\n    \"envoy.config.bootstrap.v3.Bootstrap.DynamicResources\": {\n      \"properties\": {\n        \"lds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"All :ref:`Listeners ` are provided by a single :ref:`LDS ` configuration source.\"\n        },\n        \"lds_resources_locator\": {\n          \"type\": \"string\",\n          \"description\": \"``xdstp://`` resource locator for listener collection. [#not-implemented-hide:]\"\n        },\n        \"cds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"All post-bootstrap :ref:`Cluster ` definitions are provided by a single :ref:`CDS ` configuration source.\"\n        },\n        \"cds_resources_locator\": {\n          \"type\": \"string\",\n          \"description\": \"``xdstp://`` resource locator for cluster collection. [#not-implemented-hide:]\"\n        },\n        \"ads_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ApiConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"A single :ref:`ADS ` source may be optionally specified. This must have :ref:`api_type ` :ref:`GRPC `. Only :ref:`ConfigSources ` that have the :ref:`ads ` field set will be streamed on the ADS channel.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Dynamic Resources\",\n      \"description\": \"[#next-free-field: 7]\"\n    },\n    \"envoy.config.bootstrap.v3.Bootstrap.GrpcAsyncClientManagerConfig\": {\n      \"properties\": {\n        \"max_cached_entry_idle_duration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Optional field to set the expiration time for the cached gRPC client object. The minimal value is ``5s`` and the default is ``50s``.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Grpc Async Client Manager Config\"\n    },\n    \"envoy.config.bootstrap.v3.Bootstrap.StaticResources\": {\n      \"properties\": {\n        \"listeners\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Static :ref:`Listeners `. These listeners are available regardless of LDS configuration.\"\n        },\n        \"clusters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"If a network based configuration source is specified for :ref:`cds_config `, it's necessary to have some initial cluster definitions available to allow Envoy to know how to speak to the management server.\"\n        },\n        \"secrets\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.Secret\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"These static secrets can be used by :ref:`SdsSecretConfig `\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Static Resources\"\n    },\n    \"envoy.config.bootstrap.v3.ClusterManager\": {\n      \"properties\": {\n        \"local_cluster_name\": {\n          \"type\": \"string\",\n          \"description\": \"Name of the local cluster (i.e., the cluster that owns the Envoy running this configuration). In order to enable :ref:`zone aware routing ` this option must be set. If ``local_cluster_name`` is defined then :ref:`clusters ` must be defined in the :ref:`Bootstrap static cluster resources `. This is unrelated to the :option:`--service-cluster` option which does not `affect zone aware routing `_.\"\n        },\n        \"outlier_detection\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.ClusterManager.OutlierDetection\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional global configuration for outlier detection.\"\n        },\n        \"upstream_bind_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.BindConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration used to bind newly established upstream connections. This may be overridden on a per-cluster basis by ``upstream_bind_config`` in the ``cds_config``.\"\n        },\n        \"load_stats_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ApiConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"A management server endpoint to stream load stats to via ``StreamLoadStats``. This must have :ref:`api_type ` :ref:`GRPC `.\"\n        },\n        \"enable_deferred_cluster_creation\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether the ClusterManager will create clusters on the worker threads inline during requests. This will save memory and CPU cycles in cases where there are lots of inactive clusters and ``> 1`` worker thread.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cluster Manager\",\n      \"description\": \"Cluster manager :ref:`architecture overview `. [#next-free-field: 6]\"\n    },\n    \"envoy.config.bootstrap.v3.ClusterManager.OutlierDetection\": {\n      \"properties\": {\n        \"event_log_path\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the path to the outlier event log.\"\n        },\n        \"event_service\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.EventServiceConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] The gRPC service for the outlier detection event service. If empty, outlier detection events won't be sent to a remote endpoint.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Outlier Detection\"\n    },\n    \"envoy.config.bootstrap.v3.CustomInlineHeader\": {\n      \"properties\": {\n        \"inline_header_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the header that is expected to be set as the inline header.\"\n        },\n        \"inline_header_type\": {\n          \"enum\": [\n            \"REQUEST_HEADER\",\n            0,\n            \"REQUEST_TRAILER\",\n            1,\n            \"RESPONSE_HEADER\",\n            2,\n            \"RESPONSE_TRAILER\",\n            3\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Inline Header Type\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Custom Inline Header\",\n      \"description\": \"Used to specify the header that needs to be registered as an inline header. If request or response contain multiple headers with the same name and the header name is registered as an inline header, then multiple headers will be folded into one, and multiple header values will be concatenated by a suitable delimiter. The delimiter is generally a comma. For example, if ``foo`` is registered as an inline header, and the headers contain the following two headers: .. code-block:: text   foo: bar   foo: eep Then they will eventually be folded into: .. code-block:: text   foo: bar, eep Inline headers provide O(1) search performance, but each inline header imposes an additional memory overhead on all instances of the corresponding type of HeaderMap or TrailerMap.\"\n    },\n    \"envoy.config.bootstrap.v3.FatalAction\": {\n      \"properties\": {\n        \"config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Extension specific configuration for the action. It's expected to conform to the ``Envoy::Server::Configuration::FatalAction`` interface.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Fatal Action\",\n      \"description\": \"Fatal actions to run while crashing. Actions can be safe (meaning they are async-signal safe) or unsafe. We run all safe actions before we run unsafe actions. .. note::   If using an unsafe action that could get stuck or deadlock, it is important to   have an out of band system to terminate the process. The interface for the extension is ``Envoy::Server::Configuration::FatalAction``. ``FatalAction`` extensions live in the ``envoy.extensions.fatal_actions`` API namespace.\"\n    },\n    \"envoy.config.bootstrap.v3.LayeredRuntime\": {\n      \"properties\": {\n        \"layers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.RuntimeLayer\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The :ref:`layers ` of the runtime. This is ordered such that later layers in the list overlay earlier entries.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Layered Runtime\",\n      \"description\": \"Runtime :ref:`configuration overview `.\"\n    },\n    \"envoy.config.bootstrap.v3.MemoryAllocatorManager\": {\n      \"properties\": {\n        \"bytes_to_release\": {\n          \"type\": \"string\",\n          \"description\": \"Configures tcmalloc to perform background release of free memory in amount of bytes per ``memory_release_interval`` interval. If equals to ``0``, no memory release will occur. Defaults to ``0``.\"\n        },\n        \"memory_release_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Interval in milliseconds for memory releasing. If specified, during every interval Envoy will try to release ``bytes_to_release`` of free memory back to operating system for reuse. Defaults to ``1000`` milliseconds.\",\n          \"format\": \"regex\"\n        },\n        \"soft_memory_limit_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Sets the soft memory limit for tcmalloc. When the total memory used by tcmalloc exceeds this limit, background release will be performed more aggressively to bring memory usage below the limit. If not set, no soft memory limit is applied. .. note::     This is currently only supported with tcmalloc and not with ``gperftools``.\"\n        },\n        \"max_per_cpu_cache_size_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Sets the maximum per-CPU cache size in bytes for tcmalloc. Smaller values reduce per-CPU memory overhead at the cost of increased contention on the central free list. If not set, tcmalloc's default is used. .. note::     This is currently only supported with tcmalloc and not with ``gperftools``.\"\n        },\n        \"max_unfreed_memory_bytes\": {\n          \"type\": \"string\",\n          \"description\": \"The threshold of unfreed memory in bytes that triggers the heap shrinker to release memory back to the OS. When the difference between physical memory used and application-allocated memory exceeds this threshold, free memory is released. Defaults to ``104857600`` (100 MB).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Memory Allocator Manager\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.config.bootstrap.v3.RuntimeLayer\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Descriptive name for the runtime layer. This is only used for the runtime :http:get:`/runtime` output.\"\n        },\n        \"static_layer\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \":ref:`Static runtime ` layer. This follows the :ref:`runtime protobuf JSON representation encoding `. Unlike static xDS resources, this static layer is overridable by later layers in the runtime virtual filesystem.\"\n        },\n        \"disk_layer\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.RuntimeLayer.DiskLayer\",\n          \"additionalProperties\": false\n        },\n        \"admin_layer\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.RuntimeLayer.AdminLayer\",\n          \"additionalProperties\": false\n        },\n        \"rtds_layer\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.RuntimeLayer.RtdsLayer\",\n          \"additionalProperties\": false\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Runtime Layer\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.config.bootstrap.v3.RuntimeLayer.AdminLayer\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Admin Layer\",\n      \"description\": \":ref:`Admin console runtime ` layer.\"\n    },\n    \"envoy.config.bootstrap.v3.RuntimeLayer.DiskLayer\": {\n      \"properties\": {\n        \"symlink_root\": {\n          \"type\": \"string\",\n          \"description\": \"The implementation assumes that the file system tree is accessed via a symbolic link. An atomic link swap is used when a new tree should be switched to. This parameter specifies the path to the symbolic link. Envoy will watch the location for changes and reload the file system tree when they happen. See documentation on runtime :ref:`atomicity ` for further details on how reloads are treated.\"\n        },\n        \"subdirectory\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the subdirectory to load within the root directory. This is useful if multiple systems share the same delivery mechanism. Envoy configuration elements can be contained in a dedicated subdirectory.\"\n        },\n        \"append_service_cluster\": {\n          \"type\": \"boolean\",\n          \"description\": \":ref:`Append ` the service cluster to the path under symlink root.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Disk Layer\",\n      \"description\": \":ref:`Disk runtime ` layer.\"\n    },\n    \"envoy.config.bootstrap.v3.RuntimeLayer.RtdsLayer\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"Resource to subscribe to at the ``rtds_config`` for the RTDS layer.\"\n        },\n        \"rtds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"RTDS configuration source.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Rtds Layer\",\n      \"description\": \":ref:`Runtime Discovery Service (RTDS) ` layer.\"\n    },\n    \"envoy.config.bootstrap.v3.Watchdog\": {\n      \"properties\": {\n        \"actions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Watchdog.WatchdogAction\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Register actions that will fire on given Watchdog events. See ``WatchdogAction`` for priority of events.\"\n        },\n        \"miss_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The duration after which Envoy counts a nonresponsive thread in the ``watchdog_miss`` statistic. If not specified the default is ``200ms``.\",\n          \"format\": \"regex\"\n        },\n        \"megamiss_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The duration after which Envoy counts a nonresponsive thread in the ``watchdog_mega_miss`` statistic. If not specified the default is ``1000ms``.\",\n          \"format\": \"regex\"\n        },\n        \"kill_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If a watched thread has been nonresponsive for this duration, assume a programming error and kill the entire Envoy process. Set to ``0`` to disable kill behavior. If not specified the default is ``0`` (disabled).\",\n          \"format\": \"regex\"\n        },\n        \"max_kill_timeout_jitter\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Defines the maximum jitter used to adjust the ``kill_timeout`` if ``kill_timeout`` is enabled. Enabling this feature would help to reduce risk of synchronized watchdog kill events across proxies due to external triggers. Set to ``0`` to disable. If not specified the default is ``0`` (disabled).\",\n          \"format\": \"regex\"\n        },\n        \"multikill_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If ``max(2, ceil(registered_threads * Fraction(multikill_threshold)))`` threads have been nonresponsive for at least this duration kill the entire Envoy process. Set to ``0`` to disable this behavior. If not specified the default is ``0`` (disabled).\",\n          \"format\": \"regex\"\n        },\n        \"multikill_threshold\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Sets the threshold for ``multikill_timeout`` in terms of the percentage of nonresponsive threads required for the ``multikill_timeout``. If not specified the default is ``0``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Watchdog\",\n      \"description\": \"Envoy process watchdog configuration. When configured, this monitors for nonresponsive threads and kills the process after the configured thresholds. See the :ref:`watchdog documentation ` for more information. [#next-free-field: 8]\"\n    },\n    \"envoy.config.bootstrap.v3.Watchdog.WatchdogAction\": {\n      \"properties\": {\n        \"config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Extension specific configuration for the action.\"\n        },\n        \"event\": {\n          \"enum\": [\n            \"UNKNOWN\",\n            0,\n            \"KILL\",\n            1,\n            \"MULTIKILL\",\n            2,\n            \"MEGAMISS\",\n            3,\n            \"MISS\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Watchdog Event\",\n          \"description\": \"The events are fired in this order: ``KILL``, ``MULTIKILL``, ``MEGAMISS``, ``MISS``. Within an event type, actions execute in the order they are configured. For ``KILL``/``MULTIKILL`` there is a default ``PANIC`` that will run after the registered actions and kills the process if it wasn't already killed. It might be useful to specify several debug actions, and possibly an alternate ``FATAL`` action.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Watchdog Action\"\n    },\n    \"envoy.config.bootstrap.v3.Watchdogs\": {\n      \"properties\": {\n        \"main_thread_watchdog\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Watchdog\",\n          \"additionalProperties\": false,\n          \"description\": \"Watchdog for the main thread.\"\n        },\n        \"worker_watchdog\": {\n          \"$ref\": \"#/definitions/envoy.config.bootstrap.v3.Watchdog\",\n          \"additionalProperties\": false,\n          \"description\": \"Watchdog for the worker threads.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Watchdogs\",\n      \"description\": \"Allows you to specify different watchdog configs for different subsystems. This allows finer tuned policies for the watchdog. If a subsystem is omitted the default values for that system will be used.\"\n    },\n    \"envoy.config.cluster.v3.CircuitBreakers\": {\n      \"properties\": {\n        \"thresholds\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.CircuitBreakers.Thresholds\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"If multiple :ref:`Thresholds` are defined with the same :ref:`RoutingPriority`, the first one in the list is used. If no Thresholds is defined for a given :ref:`RoutingPriority`, the default values are used.\"\n        },\n        \"per_host_thresholds\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.CircuitBreakers.Thresholds\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Optional per-host limits which apply to each individual host in a cluster. .. note::  currently only the :ref:`max_connections  ` field is supported for per-host limits. If multiple per-host :ref:`Thresholds` are defined with the same :ref:`RoutingPriority`, the first one in the list is used. If no per-host Thresholds are defined for a given :ref:`RoutingPriority`, the cluster will not have per-host limits.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Circuit breakers]\",\n      \"description\": \"[#protodoc-title: Circuit breakers]  :ref:`Circuit breaking` settings can be specified individually for each defined priority.\"\n    },\n    \"envoy.config.cluster.v3.CircuitBreakers.Thresholds\": {\n      \"properties\": {\n        \"priority\": {\n          \"enum\": [\n            \"DEFAULT\",\n            0,\n            \"HIGH\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Common types]\",\n          \"description\": \"[#protodoc-title: Common types]  Envoy supports :ref:`upstream priority routing ` both at the route and the virtual cluster level. The current priority implementation uses different connection pool and circuit breaking settings for each priority level. This means that even for HTTP/2 requests, two physical connections will be used to an upstream host. In the future Envoy will likely support true HTTP/2 priority over a single upstream connection.\"\n        },\n        \"max_connections\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of connections that Envoy will make to the upstream cluster. If not specified, the default is 1024.\"\n        },\n        \"max_pending_requests\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of pending requests that Envoy will allow to the upstream cluster. If not specified, the default is 1024. This limit is applied as a connection limit for non-HTTP traffic.\"\n        },\n        \"max_requests\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of parallel requests that Envoy will make to the upstream cluster. If not specified, the default is 1024. This limit does not apply to non-HTTP traffic.\"\n        },\n        \"max_retries\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of parallel retries that Envoy will allow to the upstream cluster. If not specified, the default is 3.\"\n        },\n        \"retry_budget\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.CircuitBreakers.Thresholds.RetryBudget\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies a limit on concurrent retries in relation to the number of active requests. This parameter is optional. .. note::    If this field is set, the retry budget will override any configured retry circuit    breaker.\"\n        },\n        \"track_remaining\": {\n          \"type\": \"boolean\",\n          \"description\": \"If track_remaining is true, then stats will be published that expose the number of resources remaining until the circuit breakers open. If not specified, the default is false. .. note::    If a retry budget is used in lieu of the max_retries circuit breaker,    the remaining retry resources remaining will not be tracked.\"\n        },\n        \"max_connection_pools\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of connection pools per cluster that Envoy will concurrently support at once. If not specified, the default is unlimited. Set this for clusters which create a large number of connection pools. See :ref:`Circuit Breaking ` for more details.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Thresholds\",\n      \"description\": \"A Thresholds defines CircuitBreaker settings for a :ref:`RoutingPriority`. [#next-free-field: 9]\"\n    },\n    \"envoy.config.cluster.v3.CircuitBreakers.Thresholds.RetryBudget\": {\n      \"properties\": {\n        \"budget_percent\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. For example, if there are 100 active requests and the budget_percent is set to 25, there may be 25 active retries. This parameter is optional. Defaults to 20%.\"\n        },\n        \"budget_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"An optional duration in which requests will be considered when calculating the budget for retries. This parameter alters the way in which the retry budget is calculated, overriding the default behavior when specified. By default, when budget_interval is set to 0ms, only presently active and pending requests are considered when calculating the retry budget. When a non-zero budget_interval is specified, new requests are considered for the duration of budget_interval when calculating the retry budget. For example, if 10 requests start at the same time, with a specified budget_interval of 100ms, all 10 requests will be considered when calculating the retry budget for the next 100ms, regardless of if they have completed. All 10 requests will expire after the budget_interval duration. This parameter is optional. Defaults to 0ms.\",\n          \"format\": \"regex\"\n        },\n        \"min_retry_concurrency\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Specifies the minimum retry concurrency allowed for the retry budget. The limit on the number of active retries may never go below this number. This parameter is optional. Defaults to 3.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Budget\"\n    },\n    \"envoy.config.cluster.v3.Cluster\": {\n      \"properties\": {\n        \"transport_socket_matches\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.TransportSocketMatch\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration to use different transport sockets for different endpoints. The entry of ``envoy.transport_socket_match`` in the :ref:`LbEndpoint.Metadata ` is used to match against the transport sockets as they appear in the list. If a match is not found, the search continues in :ref:`LocalityLbEndpoints.Metadata `. The first :ref:`match ` is used. For example, with the following match .. code-block:: yaml  transport_socket_matches:  - name: \\\"enableMTLS\\\"    match:      acceptMTLS: true    transport_socket:      name: envoy.transport_sockets.tls      config: { ... } # tls socket configuration  - name: \\\"defaultToPlaintext\\\"    match: {}    transport_socket:      name: envoy.transport_sockets.raw_buffer Connections to the endpoints whose metadata value under ``envoy.transport_socket_match`` having \\\"acceptMTLS\\\"/\\\"true\\\" key/value pair use the \\\"enableMTLS\\\" socket configuration. If a :ref:`socket match ` with empty match criteria is provided, that always match any endpoint. For example, the \\\"defaultToPlaintext\\\" socket match in case above. If an endpoint metadata's value under ``envoy.transport_socket_match`` does not match any ``TransportSocketMatch``, the locality metadata is then checked for a match. Barring any matches in the endpoint or locality metadata, the socket configuration fallbacks to use the ``tls_context`` or ``transport_socket`` specified in this cluster. This field allows gradual and flexible transport socket configuration changes. The metadata of endpoints in EDS can indicate transport socket capabilities. For example, an endpoint's metadata can have two key value pairs as \\\"acceptMTLS\\\": \\\"true\\\", \\\"acceptPlaintext\\\": \\\"true\\\". While some other endpoints, only accepting plaintext traffic has \\\"acceptPlaintext\\\": \\\"true\\\" metadata information. Then the xDS server can configure the CDS to a client, Envoy A, to send mutual TLS traffic for endpoints with \\\"acceptMTLS\\\": \\\"true\\\", by adding a corresponding ``TransportSocketMatch`` in this field. Other client Envoys receive CDS without ``transport_socket_match`` set, and still send plain text traffic to the same cluster. This field can be used to specify custom transport socket configurations for health checks by adding matching key/value pairs in a health check's :ref:`transport socket match criteria ` field. [#comment:TODO(incfly): add a detailed architecture doc on intended usage.]\"\n        },\n        \"transport_socket_matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional matcher that selects a transport socket from :ref:`transport_socket_matches `. This matcher uses the generic xDS matcher framework to select a named transport socket based on various inputs available at transport socket selection time. Supported matching inputs: * ``endpoint_metadata``: Extract values from the selected endpoint's metadata. * ``locality_metadata``: Extract values from the endpoint's locality metadata. * ``transport_socket_filter_state``: Extract values from filter state that was explicitly shared from   downstream to upstream via ``TransportSocketOptions``. This enables flexible   downstream-connection-based matching, such as:   - Network namespace matching.   - Custom connection attributes.   - Any data explicitly passed via filter state. .. note::   Filter state sharing follows the same pattern as tunneling in Envoy. Filters must explicitly   share data by setting filter state with the appropriate sharing mode. The filter state is   then accessible via the ``transport_socket_filter_state`` input during transport socket selection. If this field is set, it takes precedence over legacy metadata-based selection performed by :ref:`transport_socket_matches ` alone. If the matcher does not yield a match, Envoy uses the default transport socket configured for the cluster. When using this field, each entry in :ref:`transport_socket_matches ` must have a unique ``name``. The matcher outcome is expected to reference one of these names.\"\n        },\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Supplies the name of the cluster which must be unique across all clusters. The cluster name is used when emitting :ref:`statistics ` if :ref:`alt_stat_name ` is not provided. Any ``:`` in the cluster name will be converted to ``_`` when emitting statistics.\"\n        },\n        \"alt_stat_name\": {\n          \"type\": \"string\",\n          \"description\": \"An optional alternative to the cluster name to be used for observability. This name is used for emitting stats for the cluster and access logging the cluster name. This will appear as additional information in configuration dumps of a cluster's current status as :ref:`observability_name ` and as an additional tag \\\"upstream_cluster.name\\\" while tracing. .. note::   Any ``:`` in the name will be converted to ``_`` when emitting statistics. This should not be confused with   :ref:`Router Filter Header `.\"\n        },\n        \"type\": {\n          \"enum\": [\n            \"STATIC\",\n            0,\n            \"STRICT_DNS\",\n            1,\n            \"LOGICAL_DNS\",\n            2,\n            \"EDS\",\n            3,\n            \"ORIGINAL_DST\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Discovery Type\",\n          \"description\": \"Refer to :ref:`service discovery type ` for an explanation on each type.\"\n        },\n        \"cluster_type\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.CustomClusterType\",\n          \"additionalProperties\": false,\n          \"description\": \"The custom cluster type.\"\n        },\n        \"eds_cluster_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.EdsClusterConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration to use for EDS updates for the Cluster.\"\n        },\n        \"connect_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The timeout for new network connections to hosts in the cluster. If not set, a default value of 5s will be used.\",\n          \"format\": \"regex\"\n        },\n        \"per_connection_buffer_limit_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Soft limit on size of the cluster\u2019s connections read and write buffers. If unspecified, an implementation defined default is applied (1MiB).\"\n        },\n        \"per_connection_buffer_high_watermark_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Optional timeout that controls how long an upstream connection is allowed to stay above the configured buffer high watermark before it is closed. If this timeout is not specified, or explicitly set to 0, connections will not be closed due to buffer high watermark usage.\",\n          \"format\": \"regex\"\n        },\n        \"lb_policy\": {\n          \"enum\": [\n            \"ROUND_ROBIN\",\n            0,\n            \"LEAST_REQUEST\",\n            1,\n            \"RING_HASH\",\n            2,\n            \"RANDOM\",\n            3,\n            \"MAGLEV\",\n            5,\n            \"CLUSTER_PROVIDED\",\n            6,\n            \"LOAD_BALANCING_POLICY_CONFIG\",\n            7\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Lb Policy\",\n          \"description\": \"Refer to :ref:`load balancer type ` architecture overview section for information on each type.\"\n        },\n        \"load_assignment\": {\n          \"$ref\": \"#/definitions/envoy.config.endpoint.v3.ClusterLoadAssignment\",\n          \"additionalProperties\": false,\n          \"description\": \"Setting this is required for specifying members of :ref:`STATIC`, :ref:`STRICT_DNS` or :ref:`LOGICAL_DNS` clusters. This field supersedes the ``hosts`` field in the v2 API. .. attention::   Setting this allows non-EDS cluster types to contain embedded EDS equivalent   :ref:`endpoint assignments`.\"\n        },\n        \"health_checks\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Optional :ref:`active health checking ` configuration for the cluster. If no configuration is specified no health checking will be done and all cluster members will be considered healthy at all times.\"\n        },\n        \"max_requests_per_connection\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Optional maximum requests for a single upstream connection. This parameter is respected by both the HTTP/1.1 and HTTP/2 connection pool implementations. If not specified, there is no limit. Setting this parameter to 1 will effectively disable keep alive. .. attention::   This field has been deprecated in favor of the :ref:`max_requests_per_connection ` field.\"\n        },\n        \"circuit_breakers\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.CircuitBreakers\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional :ref:`circuit breaking ` for the cluster.\"\n        },\n        \"upstream_http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.UpstreamHttpProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP protocol options that are applied only to upstream HTTP connections. These options apply to all HTTP versions. This has been deprecated in favor of :ref:`upstream_http_protocol_options ` in the :ref:`http_protocol_options ` message. upstream_http_protocol_options can be set via the cluster's :ref:`extension_protocol_options`. See :ref:`upstream_http_protocol_options ` for example usage.\"\n        },\n        \"common_http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HttpProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional options when handling HTTP requests upstream. These options will be applicable to both HTTP1 and HTTP2 requests. This has been deprecated in favor of :ref:`common_http_protocol_options ` in the :ref:`http_protocol_options ` message. common_http_protocol_options can be set via the cluster's :ref:`extension_protocol_options`. See :ref:`upstream_http_protocol_options ` for example usage.\"\n        },\n        \"http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional options when handling HTTP1 requests. This has been deprecated in favor of http_protocol_options fields in the :ref:`http_protocol_options ` message. http_protocol_options can be set via the cluster's :ref:`extension_protocol_options`. See :ref:`upstream_http_protocol_options ` for example usage.\"\n        },\n        \"http2_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http2ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Even if default HTTP2 protocol options are desired, this field must be set so that Envoy will assume that the upstream supports HTTP/2 when making new HTTP connection pool connections. Currently, Envoy only supports prior knowledge for upstream connections. Even if TLS is used with ALPN, ``http2_protocol_options`` must be specified. As an aside this allows HTTP/2 connections to happen over plain text. This has been deprecated in favor of http2_protocol_options fields in the :ref:`http_protocol_options ` message. http2_protocol_options can be set via the cluster's :ref:`extension_protocol_options`. See :ref:`upstream_http_protocol_options ` for example usage.\"\n        },\n        \"typed_extension_protocol_options\": {\n          \"additionalProperties\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"type\": \"object\",\n          \"description\": \"The extension_protocol_options field is used to provide extension-specific protocol options for upstream connections. The key should match the extension filter name, such as \\\"envoy.filters.network.thrift_proxy\\\". See the extension's documentation for details on specific options. [#next-major-version: make this a list of typed extensions.] [#extension-category: envoy.upstream_options]\"\n        },\n        \"dns_refresh_rate\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If the DNS refresh rate is specified and the cluster type is either :ref:`STRICT_DNS`, or :ref:`LOGICAL_DNS`, this value is used as the cluster\u2019s DNS refresh rate. The value configured must be at least 1ms. If this setting is not specified, the value defaults to 5000ms. For cluster types other than :ref:`STRICT_DNS` and :ref:`LOGICAL_DNS` this setting is ignored. This field is deprecated in favor of using the :ref:`cluster_type` extension point and configuring it with :ref:`DnsCluster`. If :ref:`cluster_type` is configured with :ref:`DnsCluster`, this field will be ignored.\",\n          \"format\": \"regex\"\n        },\n        \"dns_jitter\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"DNS jitter can be optionally specified if the cluster type is either :ref:`STRICT_DNS`, or :ref:`LOGICAL_DNS`. DNS jitter causes the cluster to refresh DNS entries later by a random amount of time to avoid a stampede of DNS requests. This value sets the upper bound (exclusive) for the random amount. There will be no jitter if this value is omitted. For cluster types other than :ref:`STRICT_DNS` and :ref:`LOGICAL_DNS` this setting is ignored. This field is deprecated in favor of using the :ref:`cluster_type` extension point and configuring it with :ref:`DnsCluster`. If :ref:`cluster_type` is configured with :ref:`DnsCluster`, this field will be ignored.\",\n          \"format\": \"regex\"\n        },\n        \"dns_failure_refresh_rate\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.RefreshRate\",\n          \"additionalProperties\": false,\n          \"description\": \"If the DNS failure refresh rate is specified and the cluster type is either :ref:`STRICT_DNS`, or :ref:`LOGICAL_DNS`, this is used as the cluster\u2019s DNS refresh rate when requests are failing. If this setting is not specified, the failure refresh rate defaults to the DNS refresh rate. For cluster types other than :ref:`STRICT_DNS` and :ref:`LOGICAL_DNS` this setting is ignored. This field is deprecated in favor of using the :ref:`cluster_type` extension point and configuring it with :ref:`DnsCluster`. If :ref:`cluster_type` is configured with :ref:`DnsCluster`, this field will be ignored.\"\n        },\n        \"respect_dns_ttl\": {\n          \"type\": \"boolean\",\n          \"description\": \"Optional configuration for setting cluster's DNS refresh rate. If the value is set to true, cluster's DNS refresh rate will be set to resource record's TTL which comes from DNS resolution. This field is deprecated in favor of using the :ref:`cluster_type` extension point and configuring it with :ref:`DnsCluster`. If :ref:`cluster_type` is configured with :ref:`DnsCluster`, this field will be ignored.\"\n        },\n        \"dns_lookup_family\": {\n          \"enum\": [\n            \"AUTO\",\n            0,\n            \"V4_ONLY\",\n            1,\n            \"V6_ONLY\",\n            2,\n            \"V4_PREFERRED\",\n            3,\n            \"ALL\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Dns Lookup Family\",\n          \"description\": \"When V4_ONLY is selected, the DNS resolver will only perform a lookup for addresses in the IPv4 family. If V6_ONLY is selected, the DNS resolver will only perform a lookup for addresses in the IPv6 family. If AUTO is specified, the DNS resolver will first perform a lookup for addresses in the IPv6 family and fallback to a lookup for addresses in the IPv4 family. This is semantically equivalent to a non-existent V6_PREFERRED option. AUTO is a legacy name that is more opaque than necessary and will be deprecated in favor of V6_PREFERRED in a future major version of the API. If V4_PREFERRED is specified, the DNS resolver will first perform a lookup for addresses in the IPv4 family and fallback to a lookup for addresses in the IPv6 family. i.e., the callback target will only get v6 addresses if there were NO v4 addresses to return. If ALL is specified, the DNS resolver will perform a lookup for both IPv4 and IPv6 families, and return all resolved addresses. When this is used, Happy Eyeballs will be enabled for upstream connections. Refer to :ref:`Happy Eyeballs Support ` for more information. For cluster types other than :ref:`STRICT_DNS` and :ref:`LOGICAL_DNS`, this setting is ignored. [#next-major-version: deprecate AUTO in favor of a V6_PREFERRED option.]\"\n        },\n        \"dns_resolvers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.Address\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"If DNS resolvers are specified and the cluster type is either :ref:`STRICT_DNS`, or :ref:`LOGICAL_DNS`, this value is used to specify the cluster\u2019s dns resolvers. If this setting is not specified, the value defaults to the default resolver, which uses /etc/resolv.conf for configuration. For cluster types other than :ref:`STRICT_DNS` and :ref:`LOGICAL_DNS` this setting is ignored. This field is deprecated in favor of ``dns_resolution_config`` which aggregates all of the DNS resolver configuration in a single message.\"\n        },\n        \"use_tcp_for_dns_lookups\": {\n          \"type\": \"boolean\",\n          \"description\": \"Always use TCP queries instead of UDP queries for DNS lookups. This field is deprecated in favor of ``dns_resolution_config`` which aggregates all of the DNS resolver configuration in a single message.\"\n        },\n        \"dns_resolution_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DnsResolutionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"DNS resolution configuration which includes the underlying dns resolver addresses and options. This field is deprecated in favor of :ref:`typed_dns_resolver_config `.\"\n        },\n        \"typed_dns_resolver_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"DNS resolver type configuration extension. This extension can be used to configure c-ares, apple, or any other DNS resolver types and the related parameters. For example, an object of :ref:`CaresDnsResolverConfig ` can be packed into this ``typed_dns_resolver_config``. This configuration replaces the :ref:`dns_resolution_config ` configuration. During the transition period when both ``dns_resolution_config`` and ``typed_dns_resolver_config`` exists, when ``typed_dns_resolver_config`` is in place, Envoy will use it and ignore ``dns_resolution_config``. When ``typed_dns_resolver_config`` is missing, the default behavior is in place. Also note that this field is deprecated for logical dns and strict dns clusters and will be ignored when :ref:`cluster_type` is configured with :ref:`DnsCluster`. [#extension-category: envoy.network.dns_resolver]\"\n        },\n        \"wait_for_warm_on_init\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Optional configuration for having cluster readiness block on warm-up. Currently, only applicable for :ref:`STRICT_DNS`, or :ref:`LOGICAL_DNS`, or :ref:`Redis Cluster`. If true, cluster readiness blocks on warm-up. If false, the cluster will complete initialization whether or not warm-up has completed. Defaults to true.\"\n        },\n        \"outlier_detection\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.OutlierDetection\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, outlier detection will be enabled for this upstream cluster. Each of the configuration values can be overridden via :ref:`runtime values `.\"\n        },\n        \"cleanup_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval for removing stale hosts from a cluster type :ref:`ORIGINAL_DST`. Hosts are considered stale if they have not been used as upstream destinations during this interval. New hosts are added to original destination clusters on demand as new connections are redirected to Envoy, causing the number of hosts in the cluster to grow over time. Hosts that are not stale (they are actively used as destinations) are kept in the cluster, which allows connections to them remain open, saving the latency that would otherwise be spent on opening new connections. If this setting is not specified, the value defaults to 5000ms. For cluster types other than :ref:`ORIGINAL_DST` this setting is ignored.\",\n          \"format\": \"regex\"\n        },\n        \"upstream_bind_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.BindConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration used to bind newly established upstream connections. This overrides any bind_config specified in the bootstrap proto. If the address and port are empty, no bind will be performed.\"\n        },\n        \"lb_subset_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.LbSubsetConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for load balancing subsetting.\"\n        },\n        \"ring_hash_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.RingHashLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration for the Ring Hash load balancing policy.\"\n        },\n        \"maglev_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.MaglevLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration for the Maglev load balancing policy.\"\n        },\n        \"original_dst_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.OriginalDstLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration for the Original Destination load balancing policy.\"\n        },\n        \"least_request_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.LeastRequestLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration for the LeastRequest load balancing policy.\"\n        },\n        \"round_robin_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.RoundRobinLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional configuration for the RoundRobin load balancing policy.\"\n        },\n        \"common_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.CommonLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Common configuration for all load balancer implementations.\"\n        },\n        \"transport_socket\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TransportSocket\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional custom transport socket implementation to use for upstream connections. To setup TLS, set a transport socket with name ``envoy.transport_sockets.tls`` and :ref:`UpstreamTlsContexts ` in the ``typed_config``. If no transport socket configuration is specified, new connections will be set up with plaintext.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"The Metadata field can be used to provide additional information about the cluster. It can be used for stats, logging, and varying filter behavior. Fields should use reverse DNS notation to denote which entity within Envoy will need the information. For instance, if the metadata is intended for the Router filter, the filter name should be specified as ``envoy.filters.http.router``.\"\n        },\n        \"protocol_selection\": {\n          \"enum\": [\n            \"USE_CONFIGURED_PROTOCOL\",\n            0,\n            \"USE_DOWNSTREAM_PROTOCOL\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Cluster Protocol Selection\"\n        },\n        \"upstream_connection_options\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.UpstreamConnectionOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional options for upstream connections.\"\n        },\n        \"close_connections_on_host_health_failure\": {\n          \"type\": \"boolean\",\n          \"description\": \"If an upstream host becomes unhealthy (as determined by the configured health checks or outlier detection), immediately close all connections to the failed host. .. note::   This is currently only supported for connections created by tcp_proxy. .. note::   The current implementation of this feature closes all connections immediately when   the unhealthy status is detected. If there are a large number of connections open   to an upstream host that becomes unhealthy, Envoy may spend a substantial amount of   time exclusively closing these connections, and not processing any other traffic.\"\n        },\n        \"ignore_health_on_host_removal\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, Envoy will ignore the health value of a host when processing its removal from service discovery. This means that if active health checking is used, Envoy will *not* wait for the endpoint to go unhealthy before removing it.\"\n        },\n        \"filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.Filter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"An (optional) network filter chain, listed in the order the filters should be applied. The chain will be applied to all outgoing connections that Envoy makes to the upstream servers of this cluster.\"\n        },\n        \"load_balancing_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.LoadBalancingPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"If this field is set and is supported by the client, it will supersede the value of :ref:`lb_policy`.\"\n        },\n        \"lrs_server\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] If present, tells the client where to send load reports via LRS. If not present, the client will fall back to a client-side default, which may be either (a) don't send any load reports or (b) send load reports for all clusters to a single default server (which may be configured in the bootstrap file). Note that if multiple clusters point to the same LRS server, the client may choose to create a separate stream for each cluster or it may choose to coalesce the data for multiple clusters onto a single stream. Either way, the client must make sure to send the data for any given cluster on no more than one stream. [#next-major-version: In the v3 API, we should consider restructuring this somehow, maybe by allowing LRS to go on the ADS stream, or maybe by moving some of the negotiation from the LRS stream here.]\"\n        },\n        \"lrs_report_endpoint_metrics\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"A list of metric names from :ref:`ORCA load reports ` to propagate to LRS. If not specified, then ORCA load reports will not be propagated to LRS. For map fields in the ORCA proto, the string will be of the form ``.``. For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA :ref:`named_metrics ` field. The special map key ``*`` means to report all entries in the map (e.g., ``named_metrics.*`` means to report all entries in the ORCA named_metrics field). Note that this should be used only with trusted backends. The metric names in LRS will follow the same semantics as this field. In other words, if this field contains ``named_metrics.foo``, then the LRS load report will include the data with that same string as the key.\"\n        },\n        \"track_timeout_budgets\": {\n          \"type\": \"boolean\",\n          \"description\": \"If track_timeout_budgets is true, the :ref:`timeout budget histograms ` will be published for each request. These show what percentage of a request's per try and global timeout was used. A value of 0 would indicate that none of the timeout was used or that the timeout was infinite. A value of 100 would indicate that the request took the entirety of the timeout given to it. .. attention::   This field has been deprecated in favor of ``timeout_budgets``, part of   :ref:`track_cluster_stats `.\"\n        },\n        \"upstream_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional customization and configuration of upstream connection pool, and upstream type. Currently this field only applies for HTTP traffic but is designed for eventual use for custom TCP upstreams. For HTTP traffic, Envoy will generally take downstream HTTP and send it upstream as upstream HTTP, using the http connection pool and the codec from ``http2_protocol_options`` For routes where CONNECT termination is configured, Envoy will take downstream CONNECT requests and forward the CONNECT payload upstream over raw TCP using the tcp connection pool. The default pool used is the generic connection pool which creates the HTTP upstream for most HTTP requests, and the TCP upstream if CONNECT termination is configured. If users desire custom connection pool or upstream behavior, for example terminating CONNECT only if a custom filter indicates it is appropriate, the custom factories can be registered and configured here. [#extension-category: envoy.upstreams]\"\n        },\n        \"track_cluster_stats\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.TrackClusterStats\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration to track optional cluster stats.\"\n        },\n        \"preconnect_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.PreconnectPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Preconnect configuration for this cluster.\"\n        },\n        \"connection_pool_per_downstream_connection\": {\n          \"type\": \"boolean\",\n          \"description\": \"If ``connection_pool_per_downstream_connection`` is true, the cluster will use a separate connection pool for every downstream connection\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cluster\",\n      \"description\": \"Configuration for a single upstream cluster. [#next-free-field: 61]\"\n    },\n    \"envoy.config.cluster.v3.Cluster.CommonLbConfig\": {\n      \"properties\": {\n        \"healthy_panic_threshold\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Configures the :ref:`healthy panic threshold `. If not specified, the default is 50%. To disable panic mode, set to 0%. .. note::   The specified percent will be truncated to the nearest 1%.\"\n        },\n        \"zone_aware_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.CommonLbConfig.ZoneAwareLbConfig\",\n          \"additionalProperties\": false\n        },\n        \"locality_weighted_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.CommonLbConfig.LocalityWeightedLbConfig\",\n          \"additionalProperties\": false\n        },\n        \"update_merge_window\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If set, all health check/weight/metadata updates that happen within this duration will be merged and delivered in one shot when the duration expires. The start of the duration is when the first update happens. This is useful for big clusters, with potentially noisy deploys that might trigger excessive CPU usage due to a constant stream of healthcheck state changes or metadata updates. The first set of updates to be seen apply immediately (e.g.: a new cluster). Please always keep in mind that the use of sandbox technologies may change this behavior. If this is not set, we default to a merge window of 1000ms. To disable it, set the merge window to 0. .. note::   Merging does not apply to cluster membership changes (e.g.: adds/removes); this is   because merging those updates isn't currently safe. See   https://github.com/envoyproxy/envoy/pull/3941.\",\n          \"format\": \"regex\"\n        },\n        \"ignore_new_hosts_until_first_hc\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, Envoy will :ref:`exclude ` new hosts when computing load balancing weights until they have been health checked for the first time. This will have no effect unless active health checking is also configured.\"\n        },\n        \"close_connections_on_host_set_change\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to ``true``, the cluster manager will drain all existing connections to upstream hosts whenever hosts are added or removed from the cluster.\"\n        },\n        \"consistent_hashing_lb_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.CommonLbConfig.ConsistentHashingLbConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Common Configuration for all consistent hashing load balancers (MaglevLb, RingHashLb, etc.)\"\n        },\n        \"override_host_status\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthStatusSet\",\n          \"additionalProperties\": false,\n          \"description\": \"This controls what hosts are considered valid when using :ref:`host overrides `, which is used by some filters to modify the load balancing decision. If this is unset then [UNKNOWN, HEALTHY, DEGRADED] will be applied by default. If this is set with an empty set of statuses then host overrides will be ignored by the load balancing.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Common Lb Config\",\n      \"description\": \"Common configuration for all load balancer implementations. [#next-free-field: 9]\"\n    },\n    \"envoy.config.cluster.v3.Cluster.CommonLbConfig.ConsistentHashingLbConfig\": {\n      \"properties\": {\n        \"use_hostname_for_hashing\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to ``true``, the cluster will use hostname instead of the resolved address as the key to consistently hash to an upstream host. Only valid for StrictDNS clusters with hostnames which resolve to a single IP address.\"\n        },\n        \"hash_balance_factor\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Configures percentage of average cluster load to bound per upstream host. For example, with a value of 150 no upstream host will get a load more than 1.5 times the average load of all the hosts in the cluster. If not specified, the load is not bounded for any upstream host. Typical value for this parameter is between 120 and 200. Minimum is 100. Applies to both Ring Hash and Maglev load balancers. This is implemented based on the method described in the paper https://arxiv.org/abs/1608.01350. For the specified ``hash_balance_factor``, requests to any upstream host are capped at ``hash_balance_factor/100`` times the average number of requests across the cluster. When a request arrives for an upstream host that is currently serving at its max capacity, linear probing is used to identify an eligible host. Further, the linear probe is implemented using a random jump in hosts ring/table to identify the eligible host (this technique is as described in the paper https://arxiv.org/abs/1908.08762 - the random jump avoids the cascading overflow effect when choosing the next host in the ring/table). If weights are specified on the hosts, they are respected. This is an O(N) algorithm, unlike other load balancers. Using a lower ``hash_balance_factor`` results in more hosts being probed, so use a higher value if you require better performance.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Consistent Hashing Lb Config\",\n      \"description\": \"Common Configuration for all consistent hashing load balancers (MaglevLb, RingHashLb, etc.)\"\n    },\n    \"envoy.config.cluster.v3.Cluster.CommonLbConfig.LocalityWeightedLbConfig\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Locality Weighted Lb Config\",\n      \"description\": \"Configuration for :ref:`locality weighted load balancing `\"\n    },\n    \"envoy.config.cluster.v3.Cluster.CommonLbConfig.ZoneAwareLbConfig\": {\n      \"properties\": {\n        \"routing_enabled\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Configures percentage of requests that will be considered for zone aware routing if zone aware routing is configured. If not specified, the default is 100%. * :ref:`runtime values `. * :ref:`Zone aware routing support `.\"\n        },\n        \"min_cluster_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Configures minimum upstream cluster size required for zone aware routing If upstream cluster size is less than specified, zone aware routing is not performed even if zone aware routing is configured. If not specified, the default is 6. * :ref:`runtime values `. * :ref:`Zone aware routing support `.\"\n        },\n        \"fail_traffic_on_panic\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, Envoy will not consider any hosts when the cluster is in :ref:`panic mode`. Instead, the cluster will fail all requests as if all hosts are unhealthy. This can help avoid potentially overwhelming a failing service.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Zone Aware Lb Config\",\n      \"description\": \"Configuration for :ref:`zone aware routing `.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.CustomClusterType\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The type of the cluster to instantiate. The name must match a supported cluster type.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Custom Cluster Type\",\n      \"description\": \"Extended cluster type.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.EdsClusterConfig\": {\n      \"properties\": {\n        \"eds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the source of EDS updates for this Cluster.\"\n        },\n        \"service_name\": {\n          \"type\": \"string\",\n          \"description\": \"Optional alternative to cluster name to present to EDS. This does not have the same restrictions as cluster name, i.e. it may be arbitrary length. This may be a xdstp:// URL.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Eds Cluster Config\",\n      \"description\": \"Only valid when discovery type is EDS.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.LbSubsetConfig\": {\n      \"properties\": {\n        \"fallback_policy\": {\n          \"enum\": [\n            \"NO_FALLBACK\",\n            0,\n            \"ANY_ENDPOINT\",\n            1,\n            \"DEFAULT_SUBSET\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Lb Subset Fallback Policy\",\n          \"description\": \"If NO_FALLBACK is selected, a result equivalent to no healthy hosts is reported. If ANY_ENDPOINT is selected, any cluster endpoint may be returned (subject to policy, health checks, etc). If DEFAULT_SUBSET is selected, load balancing is performed over the endpoints matching the values from the default_subset field.\"\n        },\n        \"default_subset\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Specifies the default subset of endpoints used during fallback if fallback_policy is :ref:`DEFAULT_SUBSET`. Each field in default_subset is compared to the matching LbEndpoint.Metadata under the ``envoy.lb`` namespace. It is valid for no hosts to match, in which case the behavior is the same as a fallback_policy of :ref:`NO_FALLBACK`.\"\n        },\n        \"subset_selectors\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.LbSubsetConfig.LbSubsetSelector\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"For each entry, LbEndpoint.Metadata's ``envoy.lb`` namespace is traversed and a subset is created for each unique combination of key and value. For example: .. code-block:: json   { \\\"subset_selectors\\\": [       { \\\"keys\\\": [ \\\"version\\\" ] },       { \\\"keys\\\": [ \\\"stage\\\", \\\"hardware_type\\\" ] }   ]} A subset is matched when the metadata from the selected route and weighted cluster contains the same keys and values as the subset's metadata. The same host may appear in multiple subsets.\"\n        },\n        \"locality_weight_aware\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, routing to subsets will take into account the localities and locality weights of the endpoints when making the routing decision. There are some potential pitfalls associated with enabling this feature, as the resulting traffic split after applying both a subset match and locality weights might be undesirable. Consider for example a situation in which you have 50/50 split across two localities X/Y which have 100 hosts each without subsetting. If the subset LB results in X having only 1 host selected but Y having 100, then a lot more load is being dumped on the single host in X than originally anticipated in the load balancing assignment delivered via EDS.\"\n        },\n        \"scale_locality_weight\": {\n          \"type\": \"boolean\",\n          \"description\": \"When used with locality_weight_aware, scales the weight of each locality by the ratio of hosts in the subset vs hosts in the original subset. This aims to even out the load going to an individual locality if said locality is disproportionately affected by the subset predicate.\"\n        },\n        \"panic_mode_any\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, when a fallback policy is configured and its corresponding subset fails to find a host this will cause any host to be selected instead. This is useful when using the default subset as the fallback policy, given the default subset might become empty. With this option enabled, if that happens the LB will attempt to select a host from the entire cluster.\"\n        },\n        \"list_as_any\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, metadata specified for a metadata key will be matched against the corresponding endpoint metadata if the endpoint metadata matches the value exactly OR it is a list value and any of the elements in the list matches the criteria.\"\n        },\n        \"metadata_fallback_policy\": {\n          \"enum\": [\n            \"METADATA_NO_FALLBACK\",\n            0,\n            \"FALLBACK_LIST\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Lb Subset Metadata Fallback Policy\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Lb Subset Config\",\n      \"description\": \"Optionally divide the endpoints in this cluster into subsets defined by endpoint metadata and selected by route and weighted cluster metadata. [#next-free-field: 9]\"\n    },\n    \"envoy.config.cluster.v3.Cluster.LbSubsetConfig.LbSubsetSelector\": {\n      \"properties\": {\n        \"keys\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"List of keys to match with the weighted cluster metadata.\"\n        },\n        \"single_host_per_subset\": {\n          \"type\": \"boolean\",\n          \"description\": \"Selects a mode of operation in which each subset has only one host. This mode uses the same rules for choosing a host, but updating hosts is faster, especially for large numbers of hosts. If a match is found to a host, that host will be used regardless of priority levels. When this mode is enabled, configurations that contain more than one host with the same metadata value for the single key in ``keys`` will use only one of the hosts with the given key; no requests will be routed to the others. The cluster gauge :ref:`lb_subsets_single_host_per_subset_duplicate` indicates how many duplicates are present in the current configuration.\"\n        },\n        \"fallback_policy\": {\n          \"enum\": [\n            \"NOT_DEFINED\",\n            0,\n            \"NO_FALLBACK\",\n            1,\n            \"ANY_ENDPOINT\",\n            2,\n            \"DEFAULT_SUBSET\",\n            3,\n            \"KEYS_SUBSET\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Lb Subset Selector Fallback Policy\",\n          \"description\": \"Allows to override top level fallback policy per selector.\"\n        },\n        \"fallback_keys_subset\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Subset of :ref:`keys` used by :ref:`KEYS_SUBSET` fallback policy. It has to be a non empty list if KEYS_SUBSET fallback policy is selected. For any other fallback policy the parameter is not used and should not be set. Only values also present in :ref:`keys` are allowed, but ``fallback_keys_subset`` cannot be equal to ``keys``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Lb Subset Selector\",\n      \"description\": \"Specifications for subsets.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.LeastRequestLbConfig\": {\n      \"properties\": {\n        \"choice_count\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of random healthy hosts from which the host with the fewest active requests will be chosen. Defaults to 2 so that we perform two-choice selection if the field is not set.\"\n        },\n        \"active_request_bias\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeDouble\",\n          \"additionalProperties\": false,\n          \"description\": \"The following formula is used to calculate the dynamic weights when hosts have different load balancing weights: ``weight = load_balancing_weight / (active_requests + 1)^active_request_bias`` The larger the active request bias is, the more aggressively active requests will lower the effective weight when all host weights are not equal. ``active_request_bias`` must be greater than or equal to 0.0. When ``active_request_bias == 0.0`` the Least Request Load Balancer doesn't consider the number of active requests at the time it picks a host and behaves like the Round Robin Load Balancer. When ``active_request_bias > 0.0`` the Least Request Load Balancer scales the load balancing weight by the number of active requests at the time it does a pick. The value is cached for performance reasons and refreshed whenever one of the Load Balancer's host sets changes, e.g., whenever there is a host membership update or a host load balancing weight change. .. note::   This setting only takes effect if all host weights are not equal.\"\n        },\n        \"slow_start_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.SlowStartConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for slow start mode. If this configuration is not set, slow start will not be not enabled.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Least Request Lb Config\",\n      \"description\": \"Specific configuration for the LeastRequest load balancing policy.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.MaglevLbConfig\": {\n      \"properties\": {\n        \"table_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"The table size for Maglev hashing. Maglev aims for \\\"minimal disruption\\\" rather than an absolute guarantee. Minimal disruption means that when the set of upstream hosts change, a connection will likely be sent to the same upstream as it was before. Increasing the table size reduces the amount of disruption. The table size must be prime number limited to 5000011. If it is not specified, the default is 65537.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Maglev Lb Config\",\n      \"description\": \"Specific configuration for the :ref:`Maglev` load balancing policy.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.OriginalDstLbConfig\": {\n      \"properties\": {\n        \"use_http_header\": {\n          \"type\": \"boolean\",\n          \"description\": \"When true, a HTTP header can be used to override the original dst address. The default header is :ref:`x-envoy-original-dst-host `. .. attention::   This header isn't sanitized by default, so enabling this feature allows HTTP clients to   route traffic to arbitrary hosts and/or ports, which may have serious security   consequences. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"http_header_name\": {\n          \"type\": \"string\",\n          \"description\": \"The http header to override destination address if :ref:`use_http_header `. is set to true. If the value is empty, :ref:`x-envoy-original-dst-host ` will be used.\"\n        },\n        \"upstream_port_override\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The port to override for the original dst address. This port will take precedence over filter state and header override ports\"\n        },\n        \"metadata_key\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKey\",\n          \"additionalProperties\": false,\n          \"description\": \"The dynamic metadata key to override destination address. First the request metadata is considered, then the connection one.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Original Dst Lb Config\",\n      \"description\": \"Specific configuration for the :ref:`Original Destination ` load balancing policy. [#extension: envoy.clusters.original_dst]\"\n    },\n    \"envoy.config.cluster.v3.Cluster.PreconnectPolicy\": {\n      \"properties\": {\n        \"per_upstream_preconnect_ratio\": {\n          \"additionalProperties\": false,\n          \"type\": \"number\",\n          \"description\": \"Indicates how many streams (rounded up) can be anticipated per-upstream for each incoming stream. This is useful for high-QPS or latency-sensitive services. Preconnecting will only be done if the upstream is healthy and the cluster has traffic. For example if this is 2, for an incoming HTTP/1.1 stream, 2 connections will be established, one for the new incoming stream, and one for a presumed follow-up stream. For HTTP/2, only one connection would be established by default as one connection can serve both the original and presumed follow-up stream. In steady state for non-multiplexed connections a value of 1.5 would mean if there were 100 active streams, there would be 100 connections in use, and 50 connections preconnected. This might be a useful value for something like short lived single-use connections, for example proxying HTTP/1.1 if keep-alive were false and each stream resulted in connection termination. It would likely be overkill for long lived connections, such as TCP proxying SMTP or regular HTTP/1.1 with keep-alive. For long lived traffic, a value of 1.05 would be more reasonable, where for every 100 connections, 5 preconnected connections would be in the queue in case of unexpected disconnects where the connection could not be reused. If this value is not set, or set explicitly to one, Envoy will fetch as many connections as needed to serve streams in flight. This means in steady state if a connection is torn down, a subsequent streams will pay an upstream-rtt latency penalty waiting for a new connection. This is limited somewhat arbitrarily to 3 because preconnecting too aggressively can harm latency more than the preconnecting helps.\"\n        },\n        \"predictive_preconnect_ratio\": {\n          \"additionalProperties\": false,\n          \"type\": \"number\",\n          \"description\": \"Indicates how many streams (rounded up) can be anticipated across a cluster for each stream, useful for low QPS services. This is currently supported for a subset of deterministic non-hash-based load-balancing algorithms (weighted round robin, random). Unlike ``per_upstream_preconnect_ratio`` this preconnects across the upstream instances in a cluster, doing best effort predictions of what upstream would be picked next and pre-establishing a connection. Preconnecting will be limited to one preconnect per configured upstream in the cluster and will only be done if there are healthy upstreams and the cluster has traffic. For example if preconnecting is set to 2 for a round robin HTTP/2 cluster, on the first incoming stream, 2 connections will be preconnected - one to the first upstream for this cluster, one to the second on the assumption there will be a follow-up stream. If this value is not set, or set explicitly to one, Envoy will fetch as many connections as needed to serve streams in flight, so during warm up and in steady state if a connection is closed (and per_upstream_preconnect_ratio is not set), there will be a latency hit for connection establishment. If both this and preconnect_ratio are set, Envoy will make sure both predicted needs are met, basically preconnecting max(predictive-preconnect, per-upstream-preconnect), for each upstream. This is limited somewhat arbitrarily to 3 because preconnecting too aggressively can harm latency more than the preconnecting helps.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Preconnect Policy\"\n    },\n    \"envoy.config.cluster.v3.Cluster.RefreshRate\": {\n      \"properties\": {\n        \"base_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the base interval between refreshes. This parameter is required and must be greater than zero and less than :ref:`max_interval `.\",\n          \"format\": \"regex\"\n        },\n        \"max_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the maximum interval between refreshes. This parameter is optional, but must be greater than or equal to the :ref:`base_interval `  if set. The default is 10 times the :ref:`base_interval `.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Refresh Rate\"\n    },\n    \"envoy.config.cluster.v3.Cluster.RingHashLbConfig\": {\n      \"properties\": {\n        \"minimum_ring_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Minimum hash ring size. The larger the ring is (that is, the more hashes there are for each provided host) the better the request distribution will reflect the desired weights. Defaults to 1024 entries, and limited to 8M entries. See also :ref:`maximum_ring_size`.\"\n        },\n        \"hash_function\": {\n          \"enum\": [\n            \"XX_HASH\",\n            0,\n            \"MURMUR_HASH_2\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Hash Function\",\n          \"description\": \"The hash function used to hash hosts onto the ketama ring.\"\n        },\n        \"maximum_ring_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Maximum hash ring size. Defaults to 8M entries, and limited to 8M entries, but can be lowered to further constrain resource use. See also :ref:`minimum_ring_size`.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Ring Hash Lb Config\",\n      \"description\": \"Specific configuration for the :ref:`RingHash` load balancing policy.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.RoundRobinLbConfig\": {\n      \"properties\": {\n        \"slow_start_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.Cluster.SlowStartConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for slow start mode. If this configuration is not set, slow start will not be not enabled.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Round Robin Lb Config\",\n      \"description\": \"Specific configuration for the RoundRobin load balancing policy.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.SlowStartConfig\": {\n      \"properties\": {\n        \"slow_start_window\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Represents the size of slow start window. If set, the newly created host remains in slow start mode starting from its creation time for the duration of slow start window.\",\n          \"format\": \"regex\"\n        },\n        \"aggression\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeDouble\",\n          \"additionalProperties\": false,\n          \"description\": \"This parameter controls the speed of traffic increase over the slow start window. Defaults to 1.0, so that endpoint would get linearly increasing amount of traffic. When increasing the value for this parameter, the speed of traffic ramp-up increases non-linearly. The value of aggression parameter should be greater than 0.0. By tuning the parameter, is possible to achieve polynomial or exponential shape of ramp-up curve. During slow start window, effective weight of an endpoint would be scaled with time factor and aggression: ``new_weight = weight * max(min_weight_percent, time_factor ^ (1 / aggression))``, where ``time_factor=(time_since_start_seconds / slow_start_time_seconds)``. As time progresses, more and more traffic would be sent to endpoint, which is in slow start window. Once host exits slow start, time_factor and aggression no longer affect its weight.\"\n        },\n        \"min_weight_percent\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Configures the minimum percentage of origin weight that avoids too small new weight, which may cause endpoints in slow start mode receive no traffic in slow start window. If not specified, the default is 10%.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Slow Start Config\",\n      \"description\": \"Configuration for :ref:`slow start mode `.\"\n    },\n    \"envoy.config.cluster.v3.Cluster.TransportSocketMatch\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the match, used in stats generation.\"\n        },\n        \"match\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Optional metadata match criteria. The connection to the endpoint with metadata matching what is set in this field will use the transport socket configuration specified here. The endpoint's metadata entry in ``envoy.transport_socket_match`` is used to match against the values specified in this field.\"\n        },\n        \"transport_socket\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TransportSocket\",\n          \"additionalProperties\": false,\n          \"description\": \"The configuration of the transport socket. [#extension-category: envoy.transport_sockets.upstream]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Transport Socket Match\",\n      \"description\": \"TransportSocketMatch specifies what transport socket config will be used when the match conditions are satisfied.\"\n    },\n    \"envoy.config.cluster.v3.Filter\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the filter configuration.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"config_discovery\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ExtensionConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for an extension configuration discovery service. In case of a failure and without the default configuration, the listener closes the connections. Only one of typed_config or config_discovery can be used.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Upstream network filters]\\n Upstream network filters apply to the connections to the upstream cluster hosts.\",\n      \"description\": \"[#protodoc-title: Upstream network filters] Upstream network filters apply to the connections to the upstream cluster hosts.\"\n    },\n    \"envoy.config.cluster.v3.LoadBalancingPolicy\": {\n      \"properties\": {\n        \"policies\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.cluster.v3.LoadBalancingPolicy.Policy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Each client will iterate over the list in order and stop at the first policy that it supports. This provides a mechanism for starting to use new LB policies that are not yet supported by all clients.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Load Balancing Policy\",\n      \"description\": \"Extensible load balancing policy configuration. Every LB policy defined via this mechanism will be identified via a unique name using reverse DNS notation. If the policy needs configuration parameters, it must define a message for its own configuration, which will be stored in the config field. The name of the policy will tell clients which type of message they should expect to see in the config field. Note that there are cases where it is useful to be able to independently select LB policies for choosing a locality and for choosing an endpoint within that locality. For example, a given deployment may always use the same policy to choose the locality, but for choosing the endpoint within the locality, some clusters may use weighted-round-robin, while others may use some sort of session-based balancing. This can be accomplished via hierarchical LB policies, where the parent LB policy creates a child LB policy for each locality. For each request, the parent chooses the locality and then delegates to the child policy for that locality to choose the endpoint within the locality. To facilitate this, the config message for the top-level LB policy may include a field of type LoadBalancingPolicy that specifies the child policy.\"\n    },\n    \"envoy.config.cluster.v3.LoadBalancingPolicy.Policy\": {\n      \"properties\": {\n        \"typed_extension_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"[#extension-category: envoy.load_balancing_policies]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Policy\"\n    },\n    \"envoy.config.cluster.v3.OutlierDetection\": {\n      \"properties\": {\n        \"consecutive_5xx\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of consecutive server-side error responses (for HTTP traffic, 5xx responses; for TCP traffic, connection failures; for Redis, failure to respond PONG; etc.) before a consecutive 5xx ejection occurs. Defaults to 5. If set to 0 explicitly, consecutive 5xx ejection will be disabled.\"\n        },\n        \"interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The time interval between ejection analysis sweeps. This can result in both new ejections as well as hosts being returned to service. Defaults to 10000ms or 10s.\",\n          \"format\": \"regex\"\n        },\n        \"base_ejection_time\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The base time that a host is ejected for. The real time is equal to the base time multiplied by the number of times the host has been ejected and is capped by :ref:`max_ejection_time`. Defaults to 30000ms or 30s.\",\n          \"format\": \"regex\"\n        },\n        \"max_ejection_percent\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% . Will eject at least one host regardless of the value if :ref:`always_eject_one_host` is enabled.\"\n        },\n        \"enforcing_consecutive_5xx\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.\"\n        },\n        \"enforcing_success_rate\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through success rate statistics. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100.\"\n        },\n        \"success_rate_minimum_hosts\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of hosts in a cluster that must have enough request volume to detect success rate outliers. If the number of hosts is less than this setting, outlier detection via success rate statistics is not performed for any host in the cluster. Defaults to 5.\"\n        },\n        \"success_rate_request_volume\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The minimum number of total requests that must be collected in one interval (as defined by the interval duration above) to include this host in success rate based outlier detection. If the volume is lower than this setting, outlier detection via success rate statistics is not performed for that host. Defaults to 100.\"\n        },\n        \"success_rate_stdev_factor\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"This factor is used to determine the ejection threshold for success rate outlier ejection. The ejection threshold is the difference between the mean success rate, and the product of this factor and the standard deviation of the mean success rate: mean - (stdev * success_rate_stdev_factor). This factor is divided by a thousand to get a double. That is, if the desired factor is 1.9, the runtime value should be 1900. Defaults to 1900.\"\n        },\n        \"consecutive_gateway_failure\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of consecutive gateway failures (502, 503, 504 status codes) before a consecutive gateway failure ejection occurs. Defaults to 5. If set to 0 explicitly, consecutive gateway failure ejection will be disabled.\"\n        },\n        \"enforcing_consecutive_gateway_failure\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through consecutive gateway failures. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 0.\"\n        },\n        \"split_external_local_origin_errors\": {\n          \"type\": \"boolean\",\n          \"description\": \"Determines whether to distinguish local origin failures from external errors. If set to true the following configuration parameters are taken into account: :ref:`consecutive_local_origin_failure`, :ref:`enforcing_consecutive_local_origin_failure` and :ref:`enforcing_local_origin_success_rate`. Defaults to false.\"\n        },\n        \"consecutive_local_origin_failure\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of consecutive locally originated failures before ejection occurs. Defaults to 5. Parameter takes effect only when :ref:`split_external_local_origin_errors` is set to true. If set to 0 explicitly, consecutive locally originated failure ejection will be disabled.\"\n        },\n        \"enforcing_consecutive_local_origin_failure\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through consecutive locally originated failures. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100. Parameter takes effect only when :ref:`split_external_local_origin_errors` is set to true.\"\n        },\n        \"enforcing_local_origin_success_rate\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through success rate statistics for locally originated errors. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 100. Parameter takes effect only when :ref:`split_external_local_origin_errors` is set to true.\"\n        },\n        \"failure_percentage_threshold\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The failure percentage to use when determining failure percentage-based outlier detection. If the failure percentage of a given host is greater than or equal to this value, it will be ejected. Defaults to 85.\"\n        },\n        \"enforcing_failure_percentage\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through failure percentage statistics. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 0. [#next-major-version: setting this without setting failure_percentage_threshold should be invalid in v4.]\"\n        },\n        \"enforcing_failure_percentage_local_origin\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The % chance that a host will be actually ejected when an outlier status is detected through local-origin failure percentage statistics. This setting can be used to disable ejection or to ramp it up slowly. Defaults to 0.\"\n        },\n        \"failure_percentage_minimum_hosts\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The minimum number of hosts in a cluster in order to perform failure percentage-based ejection. If the total number of hosts in the cluster is less than this value, failure percentage-based ejection will not be performed. Defaults to 5.\"\n        },\n        \"failure_percentage_request_volume\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The minimum number of total requests that must be collected in one interval (as defined by the interval duration above) to perform failure percentage-based ejection for this host. If the volume is lower than this setting, failure percentage-based ejection will not be performed for this host. Defaults to 50.\"\n        },\n        \"max_ejection_time\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The maximum time that a host is ejected for. See :ref:`base_ejection_time` for more information. If not specified, the default value (300000ms or 300s) or :ref:`base_ejection_time` value is applied, whatever is larger.\",\n          \"format\": \"regex\"\n        },\n        \"max_ejection_time_jitter\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The maximum amount of jitter to add to the ejection time, in order to prevent a 'thundering herd' effect where all proxies try to reconnect to host at the same time. See :ref:`max_ejection_time_jitter` Defaults to 0s.\",\n          \"format\": \"regex\"\n        },\n        \"successful_active_health_check_uneject_host\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If active health checking is enabled and a host is ejected by outlier detection, a successful active health check unejects the host by default and considers it as healthy. Unejection also clears all the outlier detection counters. To change this default behavior set this config to ``false`` where active health checking will not uneject the host. Defaults to true.\"\n        },\n        \"monitors\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Set of host's passive monitors. [#not-implemented-hide:]\"\n        },\n        \"always_eject_one_host\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If enabled, at least one host is ejected regardless of the value of :ref:`max_ejection_percent`. Defaults to false.\"\n        },\n        \"detect_degraded_hosts\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, outlier detection will mark hosts as degraded when they return the ``x-envoy-degraded`` header. Degraded hosts are deprioritized in load balancing but are not ejected from the cluster. The degraded state is cleared using the same backoff algorithm as ejection, with the degradation period calculated as ``base_ejection_time`` multiplied by the number of times the host has been marked as degraded, capped by ``max_ejection_time``. Defaults to false.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Outlier detection]\",\n      \"description\": \"[#protodoc-title: Outlier detection]  See the :ref:`architecture overview ` for more information on outlier detection. [#next-free-field: 27]\"\n    },\n    \"envoy.config.cluster.v3.TrackClusterStats\": {\n      \"properties\": {\n        \"timeout_budgets\": {\n          \"type\": \"boolean\",\n          \"description\": \"If timeout_budgets is true, the :ref:`timeout budget histograms ` will be published for each request. These show what percentage of a request's per try and global timeout was used. A value of 0 would indicate that none of the timeout was used or that the timeout was infinite. A value of 100 would indicate that the request took the entirety of the timeout given to it.\"\n        },\n        \"request_response_sizes\": {\n          \"type\": \"boolean\",\n          \"description\": \"If request_response_sizes is true, then the :ref:`histograms `  tracking header and body sizes of requests and responses will be published. Additionally, number of headers in the requests and responses will be tracked.\"\n        },\n        \"per_endpoint_stats\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, some stats will be emitted per-endpoint, similar to the stats in admin ``/clusters`` output. This does not currently output correct stats during a hot-restart. This is not currently implemented by all stat sinks. These stats do not honor filtering or tag extraction rules in :ref:`StatsConfig ` (but fixed-value tags are supported). Admin endpoint filtering is supported. This may not be used at the same time as :ref:`load_stats_config `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Track Cluster Stats\"\n    },\n    \"envoy.config.cluster.v3.UpstreamConnectionOptions\": {\n      \"properties\": {\n        \"tcp_keepalive\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TcpKeepalive\",\n          \"additionalProperties\": false,\n          \"description\": \"If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.\"\n        },\n        \"set_local_interface_name_on_upstream_connections\": {\n          \"type\": \"boolean\",\n          \"description\": \"If enabled, associates the interface name of the local address with the upstream connection. This can be used by extensions during processing of requests. The association mechanism is implementation specific. Defaults to false due to performance concerns.\"\n        },\n        \"happy_eyeballs_config\": {\n          \"$ref\": \"#/definitions/envoy.config.cluster.v3.UpstreamConnectionOptions.HappyEyeballsConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configurations for happy eyeballs algorithm. Add configs for first_address_family_version and first_address_family_count when sorting destination ip addresses.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Upstream Connection Options\"\n    },\n    \"envoy.config.cluster.v3.UpstreamConnectionOptions.HappyEyeballsConfig\": {\n      \"properties\": {\n        \"first_address_family_version\": {\n          \"enum\": [\n            \"DEFAULT\",\n            0,\n            \"V4\",\n            1,\n            \"V6\",\n            2,\n            \"PIPE\",\n            3,\n            \"INTERNAL\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"First Address Family Version\",\n          \"description\": \"[#comment: Keep this list of address types in sync with api/config/core/v3/address.proto.]\"\n        },\n        \"first_address_family_count\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Specify the number of addresses of the first_address_family_version being attempted for connection before the other address family.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Happy Eyeballs Config\"\n    },\n    \"envoy.config.core.v3.Address\": {\n      \"properties\": {\n        \"socket_address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketAddress\",\n          \"additionalProperties\": false\n        },\n        \"pipe\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Pipe\",\n          \"additionalProperties\": false\n        },\n        \"envoy_internal_address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.EnvoyInternalAddress\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies a user-space address handled by :ref:`internal listeners `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Address\",\n      \"description\": \"Addresses specify either a logical or physical address and port, which are used to tell Envoy where to bind/listen, connect to upstream and find management servers.\"\n    },\n    \"envoy.config.core.v3.AggregatedConfigSource\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Aggregated Config Source\",\n      \"description\": \"Aggregated Discovery Service (ADS) options. This is currently empty, but when set in :ref:`ConfigSource ` can be used to specify that ADS is to be used.\"\n    },\n    \"envoy.config.core.v3.ApiConfigSource\": {\n      \"properties\": {\n        \"api_type\": {\n          \"enum\": [\n            \"DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE\",\n            0,\n            \"REST\",\n            1,\n            \"GRPC\",\n            2,\n            \"DELTA_GRPC\",\n            3,\n            \"AGGREGATED_GRPC\",\n            5,\n            \"AGGREGATED_DELTA_GRPC\",\n            6\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Api Type\",\n          \"description\": \"APIs may be fetched via either REST or gRPC.\"\n        },\n        \"transport_api_version\": {\n          \"enum\": [\n            \"AUTO\",\n            0,\n            \"V2\",\n            1,\n            \"V3\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Configuration sources]\",\n          \"description\": \"[#protodoc-title: Configuration sources]  xDS API and non-xDS services version. This is used to describe both resource and transport protocol versions (in distinct configuration fields).\"\n        },\n        \"cluster_names\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Cluster names should be used only with REST. If > 1 cluster is defined, clusters will be cycled through if any kind of failure occurs. .. note::  The cluster with name ``cluster_name`` must be statically defined and its  type must not be ``EDS``.\"\n        },\n        \"grpc_services\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Multiple gRPC services be provided for GRPC. If > 1 cluster is defined, services will be cycled through if any kind of failure occurs.\"\n        },\n        \"refresh_delay\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"For REST APIs, the delay between successive polls.\",\n          \"format\": \"regex\"\n        },\n        \"request_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"For REST APIs, the request timeout. If not set, a default value of 1s will be used.\",\n          \"format\": \"regex\"\n        },\n        \"rate_limit_settings\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RateLimitSettings\",\n          \"additionalProperties\": false,\n          \"description\": \"For GRPC APIs, the rate limit settings. If present, discovery requests made by Envoy will be rate limited.\"\n        },\n        \"set_node_on_first_message_only\": {\n          \"type\": \"boolean\",\n          \"description\": \"Skip the node identifier in subsequent discovery requests for streaming gRPC config types.\"\n        },\n        \"config_validators\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of config validators that will be executed when a new update is received from the ApiConfigSource. Note that each validator handles a specific xDS service type, and only the validators corresponding to the type url (in ``:ref: DiscoveryResponse`` or ``:ref: DeltaDiscoveryResponse``) will be invoked. If the validator returns false or throws an exception, the config will be rejected by the client, and a NACK will be sent. [#extension-category: envoy.config.validators]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Api Config Source\",\n      \"description\": \"API configuration source. This identifies the API type and cluster that Envoy will use to fetch an xDS API. [#next-free-field: 10]\"\n    },\n    \"envoy.config.core.v3.BackoffStrategy\": {\n      \"properties\": {\n        \"base_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The base interval to be used for the next back off computation. It should be greater than zero and less than or equal to :ref:`max_interval `.\",\n          \"format\": \"regex\"\n        },\n        \"max_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the maximum interval between retries. This parameter is optional, but must be greater than or equal to the :ref:`base_interval ` if set. The default is 10 times the :ref:`base_interval `.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Backoff strategy]\",\n      \"description\": \"[#protodoc-title: Backoff strategy]  Configuration defining a jittered exponential back off strategy.\"\n    },\n    \"envoy.config.core.v3.BindConfig\": {\n      \"properties\": {\n        \"source_address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketAddress\",\n          \"additionalProperties\": false,\n          \"description\": \"The address to bind to when creating a socket.\"\n        },\n        \"freebind\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether to set the ``IP_FREEBIND`` option when creating the socket. When this flag is set to true, allows the :ref:`source_address ` to be an IP address that is not configured on the system running Envoy. When this flag is set to false, the option ``IP_FREEBIND`` is disabled on the socket. When this flag is not set (default), the socket is not modified, i.e. the option is neither enabled nor disabled.\"\n        },\n        \"socket_options\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Additional socket options that may not be present in Envoy source code or precompiled binaries.\"\n        },\n        \"extra_source_addresses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.ExtraSourceAddress\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Extra source addresses appended to the address specified in the ``source_address`` field. This enables to specify multiple source addresses. The source address selection is determined by :ref:`local_address_selector `.\"\n        },\n        \"additional_source_addresses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.SocketAddress\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Deprecated by :ref:`extra_source_addresses `\"\n        },\n        \"local_address_selector\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Custom local address selector to override the default (i.e. :ref:`DefaultLocalAddressSelector `). [#extension-category: envoy.upstream.local_address_selector]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Bind Config\",\n      \"description\": \"[#next-free-field: 7]\"\n    },\n    \"envoy.config.core.v3.BuildVersion\": {\n      \"properties\": {\n        \"version\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.SemanticVersion\",\n          \"additionalProperties\": false,\n          \"description\": \"SemVer version of extension.\"\n        },\n        \"metadata\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Free-form build information. Envoy defines several well known keys in the source/common/version/version.h file\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Build Version\",\n      \"description\": \"BuildVersion combines SemVer version of extension with free-form build information (i.e. 'alpha', 'private-build') as a set of strings.\"\n    },\n    \"envoy.config.core.v3.CidrRange\": {\n      \"properties\": {\n        \"address_prefix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"IPv4 or IPv6 address, e.g. ``192.0.0.0`` or ``2001:db8::``.\"\n        },\n        \"prefix_len\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Length of prefix, e.g. 0, 32. Defaults to 0 when unset.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cidr Range\",\n      \"description\": \"CidrRange specifies an IP Address and a prefix length to construct the subnet mask for a `CIDR `_ range.\"\n    },\n    \"envoy.config.core.v3.ConfigSource\": {\n      \"properties\": {\n        \"authorities\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/xds.core.v3.Authority\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Authorities that this config source may be used for. An authority specified in a xdstp:// URL is resolved to a ``ConfigSource`` prior to configuration fetch. This field provides the association between authority name and configuration source. [#not-implemented-hide:]\"\n        },\n        \"path\": {\n          \"type\": \"string\",\n          \"description\": \"Deprecated in favor of ``path_config_source``. Use that field instead.\"\n        },\n        \"path_config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.PathConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Local filesystem path configuration source.\"\n        },\n        \"api_config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ApiConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"API configuration source.\"\n        },\n        \"ads\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.AggregatedConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"When set, ADS will be used to fetch resources. The ADS API configuration source in the bootstrap configuration is used.\"\n        },\n        \"self\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SelfConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] When set, the client will access the resources from the same server it got the ConfigSource from, although not necessarily from the same stream. This is similar to the :ref:`ads` field, except that the client may use a different stream to the same server. As a result, this field can be used for things like LRS that cannot be sent on an ADS stream. It can also be used to link from (e.g.) LDS to RDS on the same server without requiring the management server to know its name or required credentials. [#next-major-version: In xDS v3, consider replacing the ads field with this one, since this field can implicitly mean to use the same stream in the case where the ConfigSource is provided via ADS and the specified data can also be obtained via ADS.]\"\n        },\n        \"initial_fetch_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"When this timeout is specified, Envoy will wait no longer than the specified time for first config response on this xDS subscription during the :ref:`initialization process `. After reaching the timeout, Envoy will move to the next initialization phase, even if the first config is not delivered yet. The timer is activated when the xDS API subscription starts, and is disarmed on first config update or on error. 0 means no timeout - Envoy will wait indefinitely for the first xDS config (unless another timeout applies). The default is 15s.\",\n          \"format\": \"regex\"\n        },\n        \"resource_api_version\": {\n          \"enum\": [\n            \"AUTO\",\n            0,\n            \"V2\",\n            1,\n            \"V3\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Configuration sources]\",\n          \"description\": \"[#protodoc-title: Configuration sources]  xDS API and non-xDS services version. This is used to describe both resource and transport protocol versions (in distinct configuration fields).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Config Source\",\n      \"description\": \"Configuration for :ref:`listeners `, :ref:`clusters `, :ref:`routes `, :ref:`endpoints ` etc. may either be sourced from the filesystem or from an xDS API source. Filesystem configs are watched with inotify for updates. [#next-free-field: 9]\"\n    },\n    \"envoy.config.core.v3.DataSource\": {\n      \"properties\": {\n        \"filename\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Local filesystem data source.\"\n        },\n        \"inline_bytes\": {\n          \"type\": \"string\",\n          \"description\": \"Bytes inlined in the configuration.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        },\n        \"inline_string\": {\n          \"type\": \"string\",\n          \"description\": \"String inlined in the configuration.\"\n        },\n        \"environment_variable\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Environment variable data source.\"\n        },\n        \"watched_directory\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.WatchedDirectory\",\n          \"additionalProperties\": false,\n          \"description\": \"Watched directory that is watched for file changes. If this is set explicitly, the file specified in the ``filename`` field will be reloaded when relevant file move events occur. .. note::   This field only makes sense when the ``filename`` field is set. .. note::   Envoy only updates when the file is replaced by a file move, and not when the file is   edited in place. .. note::   Not all use cases of ``DataSource`` support watching directories. It depends on the   specific usage of the ``DataSource``. See the documentation of the parent message for   details.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Data Source\",\n      \"description\": \"Data source consisting of a file, an inline value, or an environment variable. [#next-free-field: 6]\"\n    },\n    \"envoy.config.core.v3.DnsResolutionConfig\": {\n      \"properties\": {\n        \"resolvers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.Address\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of dns resolver addresses. If specified, the DNS client library will perform resolution via the underlying DNS resolvers. Otherwise, the default system resolvers (e.g., /etc/resolv.conf) will be used.\"\n        },\n        \"dns_resolver_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DnsResolverOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration of DNS resolver option flags which control the behavior of the DNS resolver.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Dns Resolution Config\",\n      \"description\": \"DNS resolution configuration which includes the underlying dns resolver addresses and options.\"\n    },\n    \"envoy.config.core.v3.DnsResolverOptions\": {\n      \"properties\": {\n        \"use_tcp_for_dns_lookups\": {\n          \"type\": \"boolean\",\n          \"description\": \"Use TCP for all DNS queries instead of the default protocol UDP.\"\n        },\n        \"no_default_search_domain\": {\n          \"type\": \"boolean\",\n          \"description\": \"Do not use the default search domains; only query hostnames as-is or as aliases.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Resolver]\",\n      \"description\": \"[#protodoc-title: Resolver]  Configuration of DNS resolver option flags which control the behavior of the DNS resolver.\"\n    },\n    \"envoy.config.core.v3.EnvoyInternalAddress\": {\n      \"properties\": {\n        \"server_listener_name\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the :ref:`name ` of the internal listener.\"\n        },\n        \"endpoint_id\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies an endpoint identifier to distinguish between multiple endpoints for the same internal listener in a single upstream pool. Only used in the upstream addresses for tracking changes to individual endpoints. This, for example, may be set to the final destination IP for the target internal listener.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Envoy Internal Address\",\n      \"description\": \"The address represents an envoy internal listener. [#comment: TODO(asraa): When address available, remove workaround from test/server/server_fuzz_test.cc:30.]\"\n    },\n    \"envoy.config.core.v3.EventServiceConfig\": {\n      \"properties\": {\n        \"grpc_service\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the gRPC service that hosts the event reporting service.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Event Service Config\",\n      \"description\": \"[#not-implemented-hide:] Configuration of the event reporting service endpoint.\"\n    },\n    \"envoy.config.core.v3.Extension\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"This is the name of the Envoy filter as specified in the Envoy configuration, e.g. envoy.filters.http.router, com.acme.widget.\"\n        },\n        \"category\": {\n          \"type\": \"string\",\n          \"description\": \"Category of the extension. Extension category names use reverse DNS notation. For instance \\\"envoy.filters.listener\\\" for Envoy's built-in listener filters or \\\"com.acme.filters.http\\\" for HTTP filters from acme.com vendor. [#comment:TODO(yanavlasov): Link to the doc with existing envoy category names.]\"\n        },\n        \"type_descriptor\": {\n          \"type\": \"string\",\n          \"description\": \"[#not-implemented-hide:] Type descriptor of extension configuration proto. [#comment:TODO(yanavlasov): Link to the doc with existing configuration protos.] [#comment:TODO(yanavlasov): Add tests when PR #9391 lands.]\"\n        },\n        \"version\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.BuildVersion\",\n          \"additionalProperties\": false,\n          \"description\": \"The version is a property of the extension and maintained independently of other extensions and the Envoy API. This field is not set when extension did not provide version information.\"\n        },\n        \"disabled\": {\n          \"type\": \"boolean\",\n          \"description\": \"Indicates that the extension is present but was disabled via dynamic configuration.\"\n        },\n        \"type_urls\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Type URLs of extension configuration protos.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Extension\",\n      \"description\": \"Version and identification for an Envoy extension. [#next-free-field: 7]\"\n    },\n    \"envoy.config.core.v3.ExtensionConfigSource\": {\n      \"properties\": {\n        \"config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false\n        },\n        \"default_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"apply_default_config_without_warming\": {\n          \"type\": \"boolean\",\n          \"description\": \"Use the default config as the initial configuration without warming and waiting for the first discovery response. Requires the default configuration to be supplied.\"\n        },\n        \"type_urls\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"minItems\": 1,\n          \"type\": \"array\",\n          \"description\": \"A set of permitted extension type URLs for the type encoded inside of the :ref:`TypedExtensionConfig `. Extension configuration updates are rejected if they do not match any type URL in the set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Extension Config Source\",\n      \"description\": \"Configuration source specifier for a late-bound extension configuration. The parent resource is warmed until all the initial extension configurations are received, unless the flag to apply the default configuration is set. Subsequent extension updates are atomic on a per-worker basis. Once an extension configuration is applied to a request or a connection, it remains constant for the duration of processing. If the initial delivery of the extension configuration fails, due to a timeout for example, the optional default configuration is applied. Without a default configuration, the extension is disabled, until an extension configuration is received. The behavior of a disabled extension depends on the context. For example, a filter chain with a disabled extension filter rejects all incoming streams.\"\n    },\n    \"envoy.config.core.v3.ExtraSourceAddress\": {\n      \"properties\": {\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketAddress\",\n          \"additionalProperties\": false,\n          \"description\": \"The additional address to bind.\"\n        },\n        \"socket_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOptionsOverride\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional socket options that may not be present in Envoy source code or precompiled binaries. If specified, this will override the :ref:`socket_options ` in the BindConfig. If specified with no :ref:`socket_options ` or an empty list of :ref:`socket_options `, it means no socket option will apply.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Extra Source Address\"\n    },\n    \"envoy.config.core.v3.GrpcService\": {\n      \"properties\": {\n        \"envoy_grpc\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.EnvoyGrpc\",\n          \"additionalProperties\": false,\n          \"description\": \"Envoy's in-built gRPC client. See the :ref:`gRPC services overview ` documentation for discussion on gRPC client selection.\"\n        },\n        \"google_grpc\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc\",\n          \"additionalProperties\": false,\n          \"description\": \"`Google C++ gRPC client `_ See the :ref:`gRPC services overview ` documentation for discussion on gRPC client selection.\"\n        },\n        \"timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The timeout for the gRPC request. This is the timeout for a specific request.\",\n          \"format\": \"regex\"\n        },\n        \"initial_metadata\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValue\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Additional metadata to include in streams initiated to the GrpcService. This can be used for scenarios in which additional ad hoc authorization headers (e.g. ``x-foo-bar: baz-key``) are to be injected. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"retry_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RetryPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional default retry policy for RPCs or streams initiated toward this gRPC service. If an async stream does not have a retry policy configured in its per\u2011stream options, this policy is used as the default. .. note::   This field is only applied by Envoy gRPC (``envoy_grpc``) clients. Google gRPC   (``google_grpc``) clients currently ignore this field. If not specified, no default retry policy is applied at the client level and retries only occur when explicitly configured in per\u2011stream options.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: gRPC services]\",\n      \"description\": \"[#protodoc-title: gRPC services]  gRPC service configuration. This is used by :ref:`ApiConfigSource ` and filter configurations. [#next-free-field: 7]\"\n    },\n    \"envoy.config.core.v3.GrpcService.EnvoyGrpc\": {\n      \"properties\": {\n        \"cluster_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the upstream gRPC cluster. SSL credentials will be supplied in the :ref:`Cluster ` :ref:`transport_socket `.\"\n        },\n        \"authority\": {\n          \"type\": \"string\",\n          \"description\": \"The ``:authority`` header in the grpc request. If this field is not set, the authority header value will be ``cluster_name``. Note that this authority does not override the SNI. The SNI is provided by the transport socket of the cluster.\"\n        },\n        \"retry_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RetryPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the retry backoff policy for re-establishing long\u2011lived xDS gRPC streams. This field is optional. If ``retry_back_off.max_interval`` is not provided, it will be set to ten times the configured ``retry_back_off.base_interval``. .. note::   This field is only honored for management\u2011plane xDS gRPC streams created from   :ref:`ApiConfigSource ` that use   ``envoy_grpc``. Data\u2011plane gRPC clients (for example external authorization or external   processing filters) must use :ref:`GrpcService.retry_policy   ` instead. If not set, xDS gRPC streams default to a base interval of 500ms and a maximum interval of 30s.\"\n        },\n        \"max_receive_message_length\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Maximum gRPC message size that is allowed to be received. If a message over this limit is received, the gRPC stream is terminated with the RESOURCE_EXHAUSTED error. This limit is applied to individual messages in the streaming response and not the total size of streaming response. Defaults to 0, which means unlimited.\"\n        },\n        \"skip_envoy_headers\": {\n          \"type\": \"boolean\",\n          \"description\": \"This provides gRPC client level control over envoy generated headers. If false, the header will be sent but it can be overridden by per stream option. If true, the header will be removed and can not be overridden by per stream option. Default to false.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Envoy Grpc\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc\": {\n      \"properties\": {\n        \"target_uri\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The target URI when using the `Google C++ gRPC client `_.\"\n        },\n        \"channel_credentials\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.ChannelCredentials\",\n          \"additionalProperties\": false,\n          \"description\": \"The channel credentials to use. See `channel credentials `_. Ignored if ``channel_credentials_plugin`` is set.\"\n        },\n        \"channel_credentials_plugin\": {\n          \"items\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of channel credentials plugins. The data plane will iterate over the list in order and stop at the first credential type that it supports. This provides a mechanism for starting to use new credential types that are not yet supported by all data planes. [#not-implemented-hide:]\"\n        },\n        \"call_credentials\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The call credentials to use. See `channel credentials `_. Ignored if ``call_credentials_plugin`` is set.\"\n        },\n        \"call_credentials_plugin\": {\n          \"items\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of call credentials plugins. All supported plugins will be used. Unsupported plugin types will be ignored. [#not-implemented-hide:]\"\n        },\n        \"stat_prefix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The human readable prefix to use when emitting statistics for the gRPC service. .. csv-table::    :header: Name, Type, Description    :widths: 1, 1, 2    streams_total, Counter, Total number of streams opened    streams_closed_, Counter, Total streams closed with \"\n        },\n        \"credentials_factory_name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the Google gRPC credentials factory to use. This must have been registered with Envoy. If this is empty, a default credentials factory will be used that sets up channel credentials based on other configuration parameters.\"\n        },\n        \"config\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Additional configuration for site-specific customizations of the Google gRPC library.\"\n        },\n        \"per_stream_buffer_limit_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"How many bytes each stream can buffer internally. If not set an implementation defined default is applied (1MiB).\"\n        },\n        \"channel_args\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.ChannelArgs\",\n          \"additionalProperties\": false,\n          \"description\": \"Custom channels args.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Google Grpc\",\n      \"description\": \"[#next-free-field: 11]\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials\": {\n      \"properties\": {\n        \"access_token\": {\n          \"type\": \"string\",\n          \"description\": \"Access token credentials. https://grpc.io/grpc/cpp/namespacegrpc.html#ad3a80da696ffdaea943f0f858d7a360d.\"\n        },\n        \"google_compute_engine\": {\n          \"additionalProperties\": false,\n          \"type\": \"object\",\n          \"description\": \"Google Compute Engine credentials. https://grpc.io/grpc/cpp/namespacegrpc.html#a6beb3ac70ff94bd2ebbd89b8f21d1f61\"\n        },\n        \"google_refresh_token\": {\n          \"type\": \"string\",\n          \"description\": \"Google refresh token credentials. https://grpc.io/grpc/cpp/namespacegrpc.html#a96901c997b91bc6513b08491e0dca37c.\"\n        },\n        \"service_account_jwt_access\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.ServiceAccountJWTAccessCredentials\",\n          \"additionalProperties\": false,\n          \"description\": \"Service Account JWT Access credentials. https://grpc.io/grpc/cpp/namespacegrpc.html#a92a9f959d6102461f66ee973d8e9d3aa.\"\n        },\n        \"google_iam\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.GoogleIAMCredentials\",\n          \"additionalProperties\": false,\n          \"description\": \"Google IAM credentials. https://grpc.io/grpc/cpp/namespacegrpc.html#a9fc1fc101b41e680d47028166e76f9d0.\"\n        },\n        \"from_plugin\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.MetadataCredentialsFromPlugin\",\n          \"additionalProperties\": false,\n          \"description\": \"Custom authenticator credentials. https://grpc.io/grpc/cpp/namespacegrpc.html#a823c6a4b19ffc71fb33e90154ee2ad07. https://grpc.io/docs/guides/auth.html#extending-grpc-to-support-other-authentication-mechanisms.\"\n        },\n        \"sts_service\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.StsService\",\n          \"additionalProperties\": false,\n          \"description\": \"Custom security token service which implements OAuth 2.0 token exchange. https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16 See https://github.com/grpc/grpc/pull/19587.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Call Credentials\",\n      \"description\": \"[#next-free-field: 8]\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.GoogleIAMCredentials\": {\n      \"properties\": {\n        \"authorization_token\": {\n          \"type\": \"string\"\n        },\n        \"authority_selector\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Google IAM Credentials\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.MetadataCredentialsFromPlugin\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Metadata Credentials From Plugin\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.ServiceAccountJWTAccessCredentials\": {\n      \"properties\": {\n        \"json_key\": {\n          \"type\": \"string\"\n        },\n        \"token_lifetime_seconds\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Service Account JWT Access Credentials\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.CallCredentials.StsService\": {\n      \"properties\": {\n        \"token_exchange_service_uri\": {\n          \"type\": \"string\",\n          \"description\": \"URI of the token exchange service that handles token exchange requests. [#comment:TODO(asraa): Add URI validation when implemented. Tracked by https://github.com/bufbuild/protoc-gen-validate/issues/303]\"\n        },\n        \"resource\": {\n          \"type\": \"string\",\n          \"description\": \"Location of the target service or resource where the client intends to use the requested security token.\"\n        },\n        \"audience\": {\n          \"type\": \"string\",\n          \"description\": \"Logical name of the target service where the client intends to use the requested security token.\"\n        },\n        \"scope\": {\n          \"type\": \"string\",\n          \"description\": \"The desired scope of the requested security token in the context of the service or resource where the token will be used.\"\n        },\n        \"requested_token_type\": {\n          \"type\": \"string\",\n          \"description\": \"Type of the requested security token.\"\n        },\n        \"subject_token_path\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The path of subject token, a security token that represents the identity of the party on behalf of whom the request is being made.\"\n        },\n        \"subject_token_type\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Type of the subject token.\"\n        },\n        \"actor_token_path\": {\n          \"type\": \"string\",\n          \"description\": \"The path of actor token, a security token that represents the identity of the acting party. The acting party is authorized to use the requested security token and act on behalf of the subject.\"\n        },\n        \"actor_token_type\": {\n          \"type\": \"string\",\n          \"description\": \"Type of the actor token.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Sts Service\",\n      \"description\": \"Security token service configuration that allows Google gRPC to fetch security token from an OAuth 2.0 authorization server. See https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16 and https://github.com/grpc/grpc/pull/19587. [#next-free-field: 10]\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.ChannelArgs\": {\n      \"properties\": {\n        \"args\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.ChannelArgs.Value\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"See grpc_types.h GRPC_ARG #defines for keys that work here.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Channel Args\",\n      \"description\": \"Channel arguments.\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.ChannelArgs.Value\": {\n      \"properties\": {\n        \"string_value\": {\n          \"type\": \"string\"\n        },\n        \"int_value\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Value\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.ChannelCredentials\": {\n      \"properties\": {\n        \"ssl_credentials\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.SslCredentials\",\n          \"additionalProperties\": false\n        },\n        \"google_default\": {\n          \"additionalProperties\": false,\n          \"type\": \"object\",\n          \"description\": \"https://grpc.io/grpc/cpp/namespacegrpc.html#a6beb3ac70ff94bd2ebbd89b8f21d1f61\"\n        },\n        \"local_credentials\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.GrpcService.GoogleGrpc.GoogleLocalCredentials\",\n          \"additionalProperties\": false\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Channel Credentials\",\n      \"description\": \"See https://grpc.io/docs/guides/auth.html#credential-types to understand Channel and Call credential types.\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.GoogleLocalCredentials\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Google Local Credentials\",\n      \"description\": \"Local channel credentials. Only UDS is supported for now. See https://github.com/grpc/grpc/pull/15909.\"\n    },\n    \"envoy.config.core.v3.GrpcService.GoogleGrpc.SslCredentials\": {\n      \"properties\": {\n        \"root_certs\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"PEM encoded server root certificates.\"\n        },\n        \"private_key\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"PEM encoded client private key.\"\n        },\n        \"cert_chain\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"PEM encoded client certificate chain.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Ssl Credentials\",\n      \"description\": \"See https://grpc.io/grpc/cpp/structgrpc_1_1_ssl_credentials_options.html.\"\n    },\n    \"envoy.config.core.v3.HeaderValue\": {\n      \"properties\": {\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Header name.\"\n        },\n        \"value\": {\n          \"type\": \"string\",\n          \"description\": \"Header value. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown header values are replaced with the empty string instead of ``-``. Header value is encoded as string. This does not work for non-utf8 characters. Only one of ``value`` or ``raw_value`` can be set.\"\n        },\n        \"raw_value\": {\n          \"type\": \"string\",\n          \"description\": \"Header value is encoded as bytes which can support non-utf8 characters. Only one of ``value`` or ``raw_value`` can be set.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Value\",\n      \"description\": \"Header name/value pair.\"\n    },\n    \"envoy.config.core.v3.HeaderValueOption\": {\n      \"properties\": {\n        \"header\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValue\",\n          \"additionalProperties\": false,\n          \"description\": \"Header name/value pair that this option applies to.\"\n        },\n        \"append\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Should the value be appended? If true (default), the value is appended to existing values. Otherwise it replaces any existing values. This field is deprecated and please use :ref:`append_action ` as replacement. .. note::   The :ref:`external authorization service ` and   :ref:`external processor service ` have   default value (``false``) for this field.\"\n        },\n        \"append_action\": {\n          \"enum\": [\n            \"APPEND_IF_EXISTS_OR_ADD\",\n            0,\n            \"ADD_IF_ABSENT\",\n            1,\n            \"OVERWRITE_IF_EXISTS_OR_ADD\",\n            2,\n            \"OVERWRITE_IF_EXISTS\",\n            3\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Header Append Action\",\n          \"description\": \"Describes the supported actions types for header append action.\"\n        },\n        \"keep_empty_value\": {\n          \"type\": \"boolean\",\n          \"description\": \"Is the header value allowed to be empty? If false (default), custom headers with empty values are dropped, otherwise they are added.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Value Option\",\n      \"description\": \"Header name/value pair plus option to control append behavior.\"\n    },\n    \"envoy.config.core.v3.HealthCheck\": {\n      \"properties\": {\n        \"timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The time to wait for a health check response. If the timeout is reached the health check attempt will be considered a failure.\",\n          \"format\": \"regex\"\n        },\n        \"interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval between health checks.\",\n          \"format\": \"regex\"\n        },\n        \"initial_jitter\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"An optional jitter amount in milliseconds. If specified, Envoy will start health checking after for a random time in ms between 0 and initial_jitter. This only applies to the first health check.\",\n          \"format\": \"regex\"\n        },\n        \"interval_jitter\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"An optional jitter amount in milliseconds. If specified, during every interval Envoy will add interval_jitter to the wait time.\",\n          \"format\": \"regex\"\n        },\n        \"interval_jitter_percent\": {\n          \"type\": \"integer\",\n          \"description\": \"An optional jitter amount as a percentage of interval_ms. If specified, during every interval Envoy will add ``interval_ms`` * ``interval_jitter_percent`` / 100 to the wait time. If interval_jitter_ms and interval_jitter_percent are both set, both of them will be used to increase the wait time.\"\n        },\n        \"unhealthy_threshold\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of unhealthy health checks required before a host is marked unhealthy. Note that for ``http`` health checking if a host responds with a code not in :ref:`expected_statuses ` or :ref:`retriable_statuses `, this threshold is ignored and the host is considered immediately unhealthy.\"\n        },\n        \"healthy_threshold\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of healthy health checks required before a host is marked healthy. Note that during startup, only a single successful health check is required to mark a host healthy.\"\n        },\n        \"alt_port\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"[#not-implemented-hide:] Non-serving port for health checking.\"\n        },\n        \"reuse_connection\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Reuse health check connection between health checks. Default is true.\"\n        },\n        \"http_health_check\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.HttpHealthCheck\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP health check.\"\n        },\n        \"tcp_health_check\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.TcpHealthCheck\",\n          \"additionalProperties\": false,\n          \"description\": \"TCP health check.\"\n        },\n        \"grpc_health_check\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.GrpcHealthCheck\",\n          \"additionalProperties\": false,\n          \"description\": \"gRPC health check.\"\n        },\n        \"custom_health_check\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.CustomHealthCheck\",\n          \"additionalProperties\": false,\n          \"description\": \"Custom health check.\"\n        },\n        \"no_traffic_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The \\\"no traffic interval\\\" is a special health check interval that is used when a cluster has never had traffic routed to it. This lower interval allows cluster information to be kept up to date, without sending a potentially large amount of active health checking traffic for no reason. Once a cluster has been used for traffic routing, Envoy will shift back to using the standard health check interval that is defined. Note that this interval takes precedence over any other. The default value for \\\"no traffic interval\\\" is 60 seconds.\",\n          \"format\": \"regex\"\n        },\n        \"no_traffic_healthy_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The \\\"no traffic healthy interval\\\" is a special health check interval that is used for hosts that are currently passing active health checking (including new hosts) when the cluster has received no traffic. This is useful for when we want to send frequent health checks with ``no_traffic_interval`` but then revert to lower frequency ``no_traffic_healthy_interval`` once a host in the cluster is marked as healthy. Once a cluster has been used for traffic routing, Envoy will shift back to using the standard health check interval that is defined. If no_traffic_healthy_interval is not set, it will default to the no traffic interval and send that interval regardless of health state.\",\n          \"format\": \"regex\"\n        },\n        \"unhealthy_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The \\\"unhealthy interval\\\" is a health check interval that is used for hosts that are marked as unhealthy. As soon as the host is marked as healthy, Envoy will shift back to using the standard health check interval that is defined. The default value for \\\"unhealthy interval\\\" is the same as \\\"interval\\\".\",\n          \"format\": \"regex\"\n        },\n        \"unhealthy_edge_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The \\\"unhealthy edge interval\\\" is a special health check interval that is used for the first health check right after a host is marked as unhealthy. For subsequent health checks Envoy will shift back to using either \\\"unhealthy interval\\\" if present or the standard health check interval that is defined. The default value for \\\"unhealthy edge interval\\\" is the same as \\\"unhealthy interval\\\".\",\n          \"format\": \"regex\"\n        },\n        \"healthy_edge_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The \\\"healthy edge interval\\\" is a special health check interval that is used for the first health check right after a host is marked as healthy. For subsequent health checks Envoy will shift back to using the standard health check interval that is defined. The default value for \\\"healthy edge interval\\\" is the same as the default interval.\",\n          \"format\": \"regex\"\n        },\n        \"event_log_path\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the path to the :ref:`health check event log `. .. attention::   This field is deprecated in favor of the extension   :ref:`event_logger ` and   :ref:`event_log_path `   in the file sink extension.\"\n        },\n        \"event_logger\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of event log sinks to process the health check event. [#extension-category: envoy.health_check.event_sinks]\"\n        },\n        \"event_service\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.EventServiceConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] The gRPC service for the health check event service. If empty, health check events won't be sent to a remote endpoint.\"\n        },\n        \"always_log_health_check_failures\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, health check failure events will always be logged. If set to false, only the initial health check failure event will be logged. The default value is false.\"\n        },\n        \"always_log_health_check_success\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, health check success events will always be logged. If set to false, only host addition event will be logged if it is the first successful health check, or if the healthy threshold is reached. The default value is false.\"\n        },\n        \"tls_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.TlsOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"This allows overriding the cluster TLS settings, just for health check connections.\"\n        },\n        \"transport_socket_match_criteria\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Optional key/value pairs that will be used to match a transport socket from those specified in the cluster's :ref:`tranport socket matches `. For example, the following match criteria .. code-block:: yaml  transport_socket_match_criteria:    useMTLS: true Will match the following :ref:`cluster socket match ` .. code-block:: yaml  transport_socket_matches:  - name: \\\"useMTLS\\\"    match:      useMTLS: true    transport_socket:      name: envoy.transport_sockets.tls      config: { ... } # tls socket configuration If this field is set, then for health checks it will supersede an entry of ``envoy.transport_socket`` in the :ref:`LbEndpoint.Metadata `. This allows using different transport socket capabilities for health checking versus proxying to the endpoint. If the key/values pairs specified do not match any :ref:`transport socket matches `, the cluster's :ref:`transport socket ` will be used for health check socket configuration.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Health Check\",\n      \"description\": \"[#next-free-field: 27]\"\n    },\n    \"envoy.config.core.v3.HealthCheck.CustomHealthCheck\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The registered name of the custom health checker.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Custom Health Check\",\n      \"description\": \"Custom health check.\"\n    },\n    \"envoy.config.core.v3.HealthCheck.GrpcHealthCheck\": {\n      \"properties\": {\n        \"service_name\": {\n          \"type\": \"string\",\n          \"description\": \"An optional service name parameter which will be sent to gRPC service in `grpc.health.v1.HealthCheckRequest `_. message. See `gRPC health-checking overview `_ for more information.\"\n        },\n        \"authority\": {\n          \"type\": \"string\",\n          \"description\": \"The value of the :authority header in the gRPC health check request. If left empty (default value), the name of the cluster this health check is associated with will be used. The authority header can be customized for a specific endpoint by setting the :ref:`hostname ` field.\"\n        },\n        \"initial_metadata\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of key-value pairs that should be added to the metadata of each GRPC call that is sent to the health checked cluster. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Grpc Health Check\",\n      \"description\": \"`grpc.health.v1.Health `_-based healthcheck. See `gRPC doc `_ for details.\"\n    },\n    \"envoy.config.core.v3.HealthCheck.HttpHealthCheck\": {\n      \"properties\": {\n        \"host\": {\n          \"type\": \"string\",\n          \"description\": \"The value of the host header in the HTTP health check request. If left empty (default value), the name of the cluster this health check is associated with will be used. The host header can be customized for a specific endpoint by setting the :ref:`hostname ` field.\"\n        },\n        \"path\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Specifies the HTTP path that will be requested during health checking. For example ``/healthcheck``.\"\n        },\n        \"send\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.Payload\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP specific payload to be sent as the request body during health checking. If specified, the method should support a request body (POST, PUT, PATCH, etc.).\"\n        },\n        \"receive\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.Payload\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP expected responses to match in the first ``response_buffer_size`` bytes of the response body. If it is set, both the expected response check and status code determine the health check. When checking the response, \u201cfuzzy\u201d matching is performed such that each payload block must be found, and in the order specified, but not necessarily contiguous. .. note::   It is recommended to set ``response_buffer_size`` based on the total Payload size for efficiency.   The default buffer size is 1024 bytes when it is not set.\"\n        },\n        \"response_buffer_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Specifies the size of response buffer in bytes that is used to Payload match. The default value is 1024. Setting to 0 implies that the Payload will be matched against the entire response.\"\n        },\n        \"request_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be added to each request that is sent to the health checked cluster. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"request_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each request that is sent to the health checked cluster.\"\n        },\n        \"expected_statuses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.v3.Int64Range\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP response statuses considered healthy. If provided, replaces default 200-only policy - 200 must be included explicitly as needed. Ranges follow half-open semantics of :ref:`Int64Range `. The start and end of each range are required. Only statuses in the range [100, 600) are allowed.\"\n        },\n        \"retriable_statuses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.v3.Int64Range\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP response statuses considered retriable. If provided, responses in this range will count towards the configured :ref:`unhealthy_threshold `, but will not result in the host being considered immediately unhealthy. Ranges follow half-open semantics of :ref:`Int64Range `. The start and end of each range are required. Only statuses in the range [100, 600) are allowed. The :ref:`expected_statuses ` field takes precedence for any range overlaps with this field i.e. if status code 200 is both retriable and expected, a 200 response will be considered a successful health check. By default all responses not in :ref:`expected_statuses ` will result in the host being considered immediately unhealthy i.e. if status code 200 is expected and there are no configured retriable statuses, any non-200 response will result in the host being marked unhealthy.\"\n        },\n        \"codec_client_type\": {\n          \"enum\": [\n            \"HTTP1\",\n            0,\n            \"HTTP2\",\n            1,\n            \"HTTP3\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: HTTP]\",\n          \"description\": \"[#protodoc-title: HTTP]\"\n        },\n        \"service_name_matcher\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"An optional service name parameter which is used to validate the identity of the health checked cluster using a :ref:`StringMatcher `. See the :ref:`architecture overview ` for more information.\"\n        },\n        \"method\": {\n          \"enum\": [\n            \"METHOD_UNSPECIFIED\",\n            0,\n            \"GET\",\n            1,\n            \"HEAD\",\n            2,\n            \"POST\",\n            3,\n            \"PUT\",\n            4,\n            \"DELETE\",\n            5,\n            \"CONNECT\",\n            6,\n            \"OPTIONS\",\n            7,\n            \"TRACE\",\n            8,\n            \"PATCH\",\n            9\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Request Method\",\n          \"description\": \"HTTP request method.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http Health Check\",\n      \"description\": \"[#next-free-field: 15]\"\n    },\n    \"envoy.config.core.v3.HealthCheck.Payload\": {\n      \"properties\": {\n        \"text\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Hex encoded payload. E.g., \\\"000000FF\\\".\"\n        },\n        \"binary\": {\n          \"type\": \"string\",\n          \"description\": \"Binary payload.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Payload\",\n      \"description\": \"Describes the encoding of the payload bytes in the payload.\"\n    },\n    \"envoy.config.core.v3.HealthCheck.TcpHealthCheck\": {\n      \"properties\": {\n        \"send\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.Payload\",\n          \"additionalProperties\": false,\n          \"description\": \"Empty payloads imply a connect-only health check.\"\n        },\n        \"receive\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HealthCheck.Payload\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"When checking the response, \u201cfuzzy\u201d matching is performed such that each payload block must be found, and in the order specified, but not necessarily contiguous.\"\n        },\n        \"proxy_protocol_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ProxyProtocolConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"When setting this value, it tries to attempt health check request with ProxyProtocol. When ``send`` is presented, they are sent after preceding ProxyProtocol header. Only ProxyProtocol header is sent when ``send`` is not presented. It allows to use both ProxyProtocol V1 and V2. In V1, it presents L3/L4. In V2, it includes LOCAL command and doesn't include L3/L4.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tcp Health Check\"\n    },\n    \"envoy.config.core.v3.HealthCheck.TlsOptions\": {\n      \"properties\": {\n        \"alpn_protocols\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies the ALPN protocols for health check connections. This is useful if the corresponding upstream is using ALPN-based :ref:`FilterChainMatch ` along with different protocols for health checks versus data connections. If empty, no ALPN protocols will be set on health check connections.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tls Options\",\n      \"description\": \"Health checks occur over the transport socket specified for the cluster. This implies that if a cluster is using a TLS-enabled transport socket, the health check will also occur over TLS. This allows overriding the cluster TLS settings, just for health check connections.\"\n    },\n    \"envoy.config.core.v3.HealthStatusSet\": {\n      \"properties\": {\n        \"statuses\": {\n          \"items\": {\n            \"enum\": [\n              \"UNKNOWN\",\n              0,\n              \"HEALTHY\",\n              1,\n              \"UNHEALTHY\",\n              2,\n              \"DRAINING\",\n              3,\n              \"TIMEOUT\",\n              4,\n              \"DEGRADED\",\n              5\n            ]\n          },\n          \"type\": \"array\",\n          \"title\": \"[#protodoc-title: Health check]\\n * Health checking :ref:`architecture overview `.\\n * If health checking is configured for a cluster, additional statistics are emitted. They are\\n   documented :ref:`here `.\",\n          \"description\": \"[#protodoc-title: Health check] * Health checking :ref:`architecture overview `. * If health checking is configured for a cluster, additional statistics are emitted. They are   documented :ref:`here `.  Endpoint health status.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Health Status Set\"\n    },\n    \"envoy.config.core.v3.Http1ProtocolOptions\": {\n      \"properties\": {\n        \"allow_absolute_url\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Handle HTTP requests with absolute URLs in the requests. These requests are generally sent by clients to forward/explicit proxies. This allows clients to configure envoy as their HTTP proxy. In Unix, for example, this is typically done by setting the ``http_proxy`` environment variable.\"\n        },\n        \"accept_http_10\": {\n          \"type\": \"boolean\",\n          \"description\": \"Handle incoming HTTP/1.0 and HTTP/0.9 requests. This is off by default, and not fully standards compliant. There is support for pre-HTTP/1.1 style connect logic, dechunking, and handling lack of client host iff ``default_host_for_http_10`` is configured.\"\n        },\n        \"default_host_for_http_10\": {\n          \"type\": \"string\",\n          \"description\": \"A default host for HTTP/1.0 requests. This is highly suggested if ``accept_http_10`` is true as Envoy does not otherwise support HTTP/1.0 without a Host header. This is a no-op if ``accept_http_10`` is not true.\"\n        },\n        \"header_key_format\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions.HeaderKeyFormat\",\n          \"additionalProperties\": false,\n          \"description\": \"Describes how the keys for headers encoded by the HTTP/1 codec should be formatted. By default, all header keys are lower cased.\"\n        },\n        \"enable_trailers\": {\n          \"type\": \"boolean\",\n          \"description\": \"Enables trailers for HTTP/1. By default the HTTP/1 codec drops proxied trailers. .. attention::   This only happens when Envoy is chunk encoding which occurs when:   - The request is HTTP/1.1.   - Is neither a ``HEAD`` only request nor a HTTP Upgrade.   - Not a response to a ``HEAD`` request.   - The ``Content-Length`` header is not present.\"\n        },\n        \"allow_chunked_length\": {\n          \"type\": \"boolean\",\n          \"description\": \"Allows Envoy to process requests/responses with both ``Content-Length`` and ``Transfer-Encoding`` headers set. By default such messages are rejected, but if option is enabled - Envoy will remove ``Content-Length`` header and process message. See `RFC7230, sec. 3.3.3 `_ for details. .. attention::   Enabling this option might lead to request smuggling vulnerability, especially if traffic   is proxied via multiple layers of proxies. [#comment:TODO: This field is ignored when the :ref:`header validation configuration ` is present.]\"\n        },\n        \"override_stream_error_on_invalid_http_message\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Allows invalid HTTP messaging. When this option is false, then Envoy will terminate HTTP/1.1 connections upon receiving an invalid HTTP message. However, when this option is true, then Envoy will leave the HTTP/1.1 connection open where possible. If set, this overrides any HCM :ref:`stream_error_on_invalid_http_messaging `.\"\n        },\n        \"send_fully_qualified_url\": {\n          \"type\": \"boolean\",\n          \"description\": \"Allows sending fully qualified URLs when proxying the first line of the response. By default, Envoy will only send the path components in the first line. If this is true, Envoy will create a fully qualified URI composing scheme (inferred if not present), host (from the host/:authority header) and path (from first line or :path header).\"\n        },\n        \"use_balsa_parser\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Hiding so that field can be removed after BalsaParser is rolled out. If set, force HTTP/1 parser: BalsaParser if true, http-parser if false. If unset, HTTP/1 parser is selected based on envoy.reloadable_features.http1_use_balsa_parser. See issue #21245.\"\n        },\n        \"allow_custom_methods\": {\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Hiding so that field can be removed. If true, and BalsaParser is used (either `use_balsa_parser` above is true, or `envoy.reloadable_features.http1_use_balsa_parser` is true and `use_balsa_parser` is unset), then every non-empty method with only valid characters is accepted. Otherwise, methods not on the hard-coded list are rejected. Once UHV is enabled, this field should be removed, and BalsaParser should allow any method. UHV validates the method, rejecting empty string or invalid characters, and provides :ref:`restrict_http_methods ` to reject custom methods.\"\n        },\n        \"ignore_http_11_upgrade\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Ignore HTTP/1.1 upgrade values matching any of the supplied matchers. .. note::   ``h2c`` upgrades are always removed for backwards compatibility, regardless of the   value in this setting.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http 1 Protocol Options\",\n      \"description\": \"[#next-free-field: 12]\"\n    },\n    \"envoy.config.core.v3.Http1ProtocolOptions.HeaderKeyFormat\": {\n      \"properties\": {\n        \"proper_case_words\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions.HeaderKeyFormat.ProperCaseWords\",\n          \"additionalProperties\": false,\n          \"description\": \"Formats the header by proper casing words: the first character and any character following a special character will be capitalized if it's an alpha character. For example, ``\\\"content-type\\\"`` becomes ``\\\"Content-Type\\\"``, and ``\\\"foo$b#$are\\\"`` becomes ``\\\"Foo$B#$Are\\\"``. .. note::   While this results in most headers following conventional casing, certain headers   are not covered. For example, the ``\\\"TE\\\"`` header will be formatted as ``\\\"Te\\\"``.\"\n        },\n        \"stateful_formatter\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for stateful formatter extensions that allow using received headers to affect the output of encoding headers. E.g., preserving case during proxying. [#extension-category: envoy.http.stateful_header_formatters]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Key Format\",\n      \"description\": \"[#next-free-field: 9]\"\n    },\n    \"envoy.config.core.v3.Http1ProtocolOptions.HeaderKeyFormat.ProperCaseWords\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Proper Case Words\"\n    },\n    \"envoy.config.core.v3.Http2ProtocolOptions\": {\n      \"properties\": {\n        \"hpack_table_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"`Maximum table size `_ (in octets) that the encoder is permitted to use for the dynamic HPACK table. Valid values range from ``0`` to ``4294967295`` (``2^32 - 1``) and defaults to ``4096``. ``0`` effectively disables header compression.\"\n        },\n        \"max_concurrent_streams\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"`Maximum concurrent streams `_ allowed for peer on one HTTP/2 connection. Valid values range from ``1`` to ``2147483647`` (``2^31 - 1``) and defaults to ``1024`` for safety and should be sufficient for most use cases. For upstream connections, this also limits how many streams Envoy will initiate concurrently on a single connection. If the limit is reached, Envoy may queue requests or establish additional connections (as allowed per circuit breaker limits). This acts as an upper bound: Envoy will lower the max concurrent streams allowed on a given connection based on upstream settings. Config dumps will reflect the configured upper bound, not the per-connection negotiated limits.\"\n        },\n        \"initial_stream_window_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"`Initial stream-level flow-control window `_ size. Valid values range from ``65535`` (``2^16 - 1``, HTTP/2 default) to ``2147483647`` (``2^31 - 1``, HTTP/2 maximum) and defaults to ``16MiB`` (``16 * 1024 * 1024``). .. note::   ``65535`` is the initial window size from HTTP/2 spec. We only support increasing the default window size now,   so it's also the minimum. This field also acts as a soft limit on the number of bytes Envoy will buffer per-stream in the HTTP/2 codec buffers. Once the buffer reaches this pointer, watermark callbacks will fire to stop the flow of data to the codec buffers.\"\n        },\n        \"initial_connection_window_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Similar to ``initial_stream_window_size``, but for connection-level flow-control window. The default is ``24MiB`` (``24 * 1024 * 1024``).\"\n        },\n        \"allow_connect\": {\n          \"type\": \"boolean\",\n          \"description\": \"Allows proxying Websocket and other upgrades over H2 connect.\"\n        },\n        \"allow_metadata\": {\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Hiding until Envoy has full metadata support. Still under implementation. DO NOT USE. Allows sending and receiving HTTP/2 METADATA frames. See [metadata docs](https://github.com/envoyproxy/envoy/blob/main/source/docs/h2_metadata.md) for more information.\"\n        },\n        \"max_outbound_frames\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Limit the number of pending outbound downstream frames of all types (frames that are waiting to be written into the socket). Exceeding this limit triggers flood mitigation and connection is terminated. The ``http2.outbound_flood`` stat tracks the number of terminated connections due to flood mitigation. The default limit is ``10000``.\"\n        },\n        \"max_outbound_control_frames\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Limit the number of pending outbound downstream frames of types ``PING``, ``SETTINGS`` and ``RST_STREAM``, preventing high memory utilization when receiving continuous stream of these frames. Exceeding this limit triggers flood mitigation and connection is terminated. The ``http2.outbound_control_flood`` stat tracks the number of terminated connections due to flood mitigation. The default limit is ``1000``.\"\n        },\n        \"max_consecutive_inbound_frames_with_empty_payload\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Limit the number of consecutive inbound frames of types ``HEADERS``, ``CONTINUATION`` and ``DATA`` with an empty payload and no end stream flag. Those frames have no legitimate use and are abusive, but might be a result of a broken HTTP/2 implementation. The ``http2.inbound_empty_frames_flood`` stat tracks the number of connections terminated due to flood mitigation. Setting this to ``0`` will terminate connection upon receiving first frame with an empty payload and no end stream flag. The default limit is ``1``.\"\n        },\n        \"max_inbound_priority_frames_per_stream\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Limit the number of inbound ``PRIORITY`` frames allowed per each opened stream. If the number of ``PRIORITY`` frames received over the lifetime of connection exceeds the value calculated using this formula::   ``max_inbound_priority_frames_per_stream`` * (1 + ``opened_streams``) the connection is terminated. For downstream connections the ``opened_streams`` is incremented when Envoy receives complete response headers from the upstream server. For upstream connection the ``opened_streams`` is incremented when Envoy sends the ``HEADERS`` frame for a new stream. The ``http2.inbound_priority_frames_flood`` stat tracks the number of connections terminated due to flood mitigation. The default limit is ``100``.\"\n        },\n        \"max_inbound_window_update_frames_per_data_frame_sent\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Limit the number of inbound ``WINDOW_UPDATE`` frames allowed per ``DATA`` frame sent. If the number of ``WINDOW_UPDATE`` frames received over the lifetime of connection exceeds the value calculated using this formula::   ``5 + 2 * (opened_streams +            max_inbound_window_update_frames_per_data_frame_sent * outbound_data_frames)`` the connection is terminated. For downstream connections the ``opened_streams`` is incremented when Envoy receives complete response headers from the upstream server. For upstream connections the ``opened_streams`` is incremented when Envoy sends the ``HEADERS`` frame for a new stream. The ``http2.inbound_window_update_frames_flood`` stat tracks the number of connections terminated due to flood mitigation. The default ``max_inbound_window_update_frames_per_data_frame_sent`` value is ``10``. Setting this to ``1`` should be enough to support HTTP/2 implementations with basic flow control, but more complex implementations that try to estimate available bandwidth require at least ``2``.\"\n        },\n        \"stream_error_on_invalid_http_messaging\": {\n          \"type\": \"boolean\",\n          \"description\": \"Allows invalid HTTP messaging and headers. When this option is disabled (default), then the whole HTTP/2 connection is terminated upon receiving invalid HEADERS frame. However, when this option is enabled, only the offending stream is terminated. This is overridden by HCM :ref:`stream_error_on_invalid_http_messaging ` iff present. This is deprecated in favor of :ref:`override_stream_error_on_invalid_http_message ` See `RFC7540, sec. 8.1 `_ for details.\"\n        },\n        \"override_stream_error_on_invalid_http_message\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Allows invalid HTTP messaging and headers. When this option is disabled (default), then the whole HTTP/2 connection is terminated upon receiving invalid HEADERS frame. However, when this option is enabled, only the offending stream is terminated. This overrides any HCM :ref:`stream_error_on_invalid_http_messaging ` See `RFC7540, sec. 8.1 `_ for details.\"\n        },\n        \"custom_settings_parameters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.Http2ProtocolOptions.SettingsParameter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"[#not-implemented-hide:] Specifies SETTINGS frame parameters to be sent to the peer, with two exceptions: 1. SETTINGS_ENABLE_PUSH (0x2) is not configurable as HTTP/2 server push is not supported by Envoy. 2. SETTINGS_ENABLE_CONNECT_PROTOCOL (0x8) is only configurable through the named field 'allow_connect'. .. note::   Custom parameters specified through this field can not also be set in the   corresponding named parameters: .. code-block:: text   ID    Field Name   ----------------   0x1   hpack_table_size   0x3   max_concurrent_streams   0x4   initial_stream_window_size Collisions will trigger config validation failure on load/update. Likewise, inconsistencies between custom parameters with the same identifier will trigger a failure. See `IANA HTTP/2 Settings `_ for standardized identifiers.\"\n        },\n        \"connection_keepalive\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.KeepaliveSettings\",\n          \"additionalProperties\": false,\n          \"description\": \"Send HTTP/2 PING frames to verify that the connection is still healthy. If the remote peer does not respond within the configured timeout, the connection will be aborted.\"\n        },\n        \"use_oghttp2_codec\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Hiding so that the field can be removed after oghttp2 is rolled out. If set, force use of a particular HTTP/2 codec: oghttp2 if true, nghttp2 if false. If unset, HTTP/2 codec is selected based on envoy.reloadable_features.http2_use_oghttp2.\"\n        },\n        \"max_metadata_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Configure the maximum amount of metadata than can be handled per stream. Defaults to ``1 MB``.\"\n        },\n        \"enable_huffman_encoding\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Controls whether to encode headers using huffman encoding. This can be useful in cases where the cpu spent encoding the headers isn't worth the network bandwidth saved e.g. for localhost. If unset, uses the data plane's default value.\"\n        },\n        \"max_header_field_size_kb\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Configures the maximum wire-encoded size in KB of an individual header field (name or value) that the ``nghttp2`` HPACK inflater will accept. This limit applies to the HPACK-compressed length on the wire, not the decoded length. If not specified, defaults to ``64`` KB which is the ``nghttp2`` default. This limit applies to headers received by the codec. When configured on the downstream HTTP Connection Manager, it limits individual request header fields. When configured on an upstream cluster, it limits individual response header fields. Due to Huffman encoding, the decoded header size that passes a given wire limit depends on the compression ratio of the content. For example, at the default ``64`` KB wire limit, highly compressible header values can be approximately ``100`` KB when decoded. Increasing this limit allows accepting larger individual headers at the cost of increased memory usage during HPACK decompression. This option only applies when using ``nghttp2``. It is a no-op for ``oghttp2``. The configured value of this field sets the per-header field size limit, which must not exceed the applicable aggregate total header size limit. Since a single header field cannot be larger than the total size allowed for all headers combined, this value is validated against :ref:`max_request_headers_kb ` when configured on the downstream HTTP Connection Manager, and against :ref:`max_response_headers_kb ` when configured on an upstream cluster. Since ``Http2ProtocolOptions`` is configured independently for downstream and upstream, different per-header field limits can be set for each direction without requiring separate request and response fields. .. note::   When increasing this limit, ensure that upstream services and other proxies in the request   path can also handle the larger individual header sizes. Mismatched limits may result in   request failures.\"\n        },\n        \"disallow_obs_text\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether to disallow obsolete text for oghttp2 in header field values. If not set, it defaults to false. From RFC 9110, https://www.rfc-editor.org/rfc/rfc9110.html#section-5.5: obs-text = %x80-FF\"\n        },\n        \"stream_reset_burst\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Configures the initial token count for the RST_STREAM rate limiter used by the ``nghttp2`` server-side connection. This uses a token-bucket algorithm where each received RST_STREAM frame consumes one token, and tokens are replenished at :ref:`stream_reset_rate ` per second. When no tokens remain, ``nghttp2`` sends GOAWAY with ``INTERNAL_ERROR`` to close the connection, protecting against CVE-2023-44487 (HTTP/2 Rapid Reset). Defaults to ``1000``. This option only applies when using ``nghttp2`` as a server. It has no effect on ``oghttp2`` or on client-side connections.\"\n        },\n        \"stream_reset_rate\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Configures the token replenishment rate (tokens per second) for the RST_STREAM rate limiter used by the ``nghttp2`` server-side connection. See :ref:`stream_reset_burst ` for details. Defaults to ``33``. This option only applies when using ``nghttp2`` as a server. It has no effect on ``oghttp2`` or on client-side connections.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http 2 Protocol Options\",\n      \"description\": \"[#next-free-field: 23]\"\n    },\n    \"envoy.config.core.v3.Http2ProtocolOptions.SettingsParameter\": {\n      \"properties\": {\n        \"identifier\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The 16 bit parameter identifier.\"\n        },\n        \"value\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The 32 bit parameter value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Settings Parameter\",\n      \"description\": \"Defines a parameter to be sent in the SETTINGS frame. See `RFC7540, sec. 6.5.1 `_ for details.\"\n    },\n    \"envoy.config.core.v3.HttpProtocolOptions\": {\n      \"properties\": {\n        \"idle_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The idle timeout for connections. The idle timeout is defined as the period in which there are no active requests. When the idle timeout is reached the connection will be closed. If the connection is an HTTP/2 downstream connection a drain sequence will occur prior to closing the connection, see :ref:`drain_timeout `. .. note::   Request based timeouts mean that HTTP/2 PINGs will not keep the connection alive. If not specified, this defaults to ``1 hour``. To disable idle timeouts explicitly set this to ``0``. .. warning::   Disabling this timeout has a highly likelihood of yielding connection leaks due to lost TCP   FIN packets, etc. If the :ref:`overload action ` \\\"envoy.overload_actions.reduce_timeouts\\\" is configured, this timeout is scaled for downstream connections according to the value for :ref:`HTTP_DOWNSTREAM_CONNECTION_IDLE `.\",\n          \"format\": \"regex\"\n        },\n        \"max_connection_duration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The maximum duration of a connection. The duration is defined as a period since a connection was established. If not set, there is no max duration. When max_connection_duration is reached, the drain sequence will kick-in. The connection will be closed after the drain timeout period if there are no active streams. See :ref:`drain_timeout `.\",\n          \"format\": \"regex\"\n        },\n        \"max_connection_duration_jitter\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Percentage-based jitter for ``max_connection_duration``. If set, the actual connection duration limit is extended by a random duration up to ``max_connection_duration * jitter / 100``. This staggers connection teardowns across time and prevents a thundering-herd of reconnects when many connections are established at roughly the same time. This field is ignored if ``max_connection_duration`` is not set. If not set, no jitter is added. .. note::   This field is currently only honored for downstream connections by the HTTP connection   manager. It is not yet supported for upstream cluster connections. This is analogous to :ref:`max_downstream_connection_duration_jitter_percentage ` in the TCP proxy filter.\"\n        },\n        \"max_headers_count\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of headers (request headers if configured on HttpConnectionManager, response headers when configured on a cluster). If unconfigured, the default maximum number of headers allowed is ``100``. The default value for requests can be overridden by setting runtime key ``envoy.reloadable_features.max_request_headers_count``. The default value for responses can be overridden by setting runtime key ``envoy.reloadable_features.max_response_headers_count``. Downstream requests that exceed this limit will receive a ``HTTP 431`` response for HTTP/1.x and cause a stream reset for HTTP/2. Upstream responses that exceed this limit will result in a ``HTTP 502`` response.\"\n        },\n        \"max_response_headers_kb\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum size of response headers. If unconfigured, the default is ``60 KiB``, except for HTTP/1 response headers which have a default of ``80 KiB``. The default value can be overridden by setting runtime key ``envoy.reloadable_features.max_response_headers_size_kb``. Responses that exceed this limit will result in a ``HTTP 503`` response. In Envoy, this setting is only valid when configured on an upstream cluster, not on the :ref:`HTTP Connection Manager `. .. note::   Currently some protocol codecs impose limits on the maximum size of a single header.   * HTTP/2 (when using nghttp2) limits a single header to around 100 KB by default. This can be     adjusted via :ref:`max_header_field_size_kb     `.   * HTTP/3 limits a single header to around 1024 KB.\"\n        },\n        \"max_stream_duration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Total duration to keep alive an HTTP request/response stream. If the time limit is reached the stream will be reset independent of any other timeouts. If not specified, this value is not set.\",\n          \"format\": \"regex\"\n        },\n        \"headers_with_underscores_action\": {\n          \"enum\": [\n            \"ALLOW\",\n            0,\n            \"REJECT_REQUEST\",\n            1,\n            \"DROP_HEADER\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Headers With Underscores Action\",\n          \"description\": \"Action to take when Envoy receives client request with header names containing underscore characters. Underscore character is allowed in header names by the RFC-7230 and this behavior is implemented as a security measure due to systems that treat '_' and '-' as interchangeable. Envoy by default allows client request headers with underscore characters.\"\n        },\n        \"max_requests_per_connection\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Optional maximum requests for both upstream and downstream connections. If not specified, there is no limit. Setting this parameter to ``1`` will effectively disable keep alive. For HTTP/2 and HTTP/3, due to concurrent stream processing, the limit is approximate.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http Protocol Options\",\n      \"description\": \"[#next-free-field: 9]\"\n    },\n    \"envoy.config.core.v3.JsonFormatOptions\": {\n      \"properties\": {\n        \"sort_properties\": {\n          \"type\": \"boolean\",\n          \"description\": \"The output JSON string properties will be sorted. .. note::   As the properties are always sorted, this option has no effect and is deprecated.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Substitution format string]\",\n      \"description\": \"[#protodoc-title: Substitution format string]  Optional configuration options to be used with json_format.\"\n    },\n    \"envoy.config.core.v3.KeepaliveSettings\": {\n      \"properties\": {\n        \"interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Send HTTP/2 PING frames at this period, in order to test that the connection is still alive. If this is zero, interval PINGs will not be sent.\",\n          \"format\": \"regex\"\n        },\n        \"timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"How long to wait for a response to a keepalive PING. If a response is not received within this time period, the connection will be aborted. .. note::   In order to prevent the influence of Head-of-line (HOL) blocking the timeout period is extended when *any* frame is received on   the connection, under the assumption that if a frame is received the connection is healthy.\",\n          \"format\": \"regex\"\n        },\n        \"interval_jitter\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"A random jitter amount as a percentage of interval that will be added to each interval. A value of zero means there will be no jitter. The default value is ``15%``.\"\n        },\n        \"connection_idle_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If the connection has been idle for this duration, send a HTTP/2 ping ahead of new stream creation, to quickly detect dead connections. If this is zero, this type of PING will not be sent. If an interval ping is outstanding, a second ping will not be sent as the interval ping will determine if the connection is dead. The same feature for HTTP/3 is given by inheritance from QUICHE which uses :ref:`connection idle_timeout ` and the current PTO of the connection to decide whether to probe before sending a new request.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Keepalive Settings\"\n    },\n    \"envoy.config.core.v3.Locality\": {\n      \"properties\": {\n        \"region\": {\n          \"type\": \"string\",\n          \"description\": \"Region this :ref:`zone ` belongs to.\"\n        },\n        \"zone\": {\n          \"type\": \"string\",\n          \"description\": \"Defines the local service zone where Envoy is running. Though optional, it should be set if discovery service routing is used and the discovery service exposes :ref:`zone data `, either in this message or via :option:`--service-zone`. The meaning of zone is context dependent, e.g. `Availability Zone (AZ) `_ on AWS, `Zone `_ on GCP, etc.\"\n        },\n        \"sub_zone\": {\n          \"type\": \"string\",\n          \"description\": \"When used for locality of upstream hosts, this field further splits zone into smaller chunks of sub-zones so they can be load balanced independently.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Locality\",\n      \"description\": \"Identifies location of where either Envoy runs or where upstream hosts run.\"\n    },\n    \"envoy.config.core.v3.Metadata\": {\n      \"properties\": {\n        \"filter_metadata\": {\n          \"additionalProperties\": {\n            \"additionalProperties\": true,\n            \"type\": \"object\"\n          },\n          \"type\": \"object\",\n          \"description\": \"Key is the reverse DNS filter name, e.g. com.acme.widget. The ``envoy.*`` namespace is reserved for Envoy's built-in filters. If both ``filter_metadata`` and :ref:`typed_filter_metadata ` fields are present in the metadata with same keys, only ``typed_filter_metadata`` field will be parsed.\"\n        },\n        \"typed_filter_metadata\": {\n          \"additionalProperties\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"type\": \"object\",\n          \"description\": \"Key is the reverse DNS filter name, e.g. com.acme.widget. The ``envoy.*`` namespace is reserved for Envoy's built-in filters. The value is encoded as google.protobuf.Any. If both :ref:`filter_metadata ` and ``typed_filter_metadata`` fields are present in the metadata with same keys, only ``typed_filter_metadata`` field will be parsed.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Metadata\",\n      \"description\": \"Metadata provides additional inputs to filters based on matched listeners, filter chains, routes and endpoints. It is structured as a map, usually from filter name (in reverse DNS format) to metadata specific to the filter. Metadata key-values for a filter are merged as connection and request handling occurs, with later values for the same key overriding earlier values. An example use of metadata is providing additional values to http_connection_manager in the envoy.http_connection_manager.access_log namespace. Another example use of metadata is to per service config info in cluster metadata, which may get consumed by multiple filters. For load balancing, Metadata provides a means to subset cluster endpoints. Endpoints have a Metadata object associated and routes contain a Metadata object to match against. There are some well defined metadata used today for this purpose: * ``{\\\"envoy.lb\\\": {\\\"canary\\\":  }}`` This indicates the canary status of an   endpoint and is also used during header processing   (x-envoy-upstream-canary) and for stats purposes. [#next-major-version: move to type/metadata/v2]\"\n    },\n    \"envoy.config.core.v3.Node\": {\n      \"properties\": {\n        \"id\": {\n          \"type\": \"string\",\n          \"description\": \"An opaque node identifier for the Envoy node. This also provides the local service node name. It should be set if any of the following features are used: :ref:`statsd `, :ref:`CDS `, and :ref:`HTTP tracing `, either in this message or via :option:`--service-node`.\"\n        },\n        \"cluster\": {\n          \"type\": \"string\",\n          \"description\": \"Defines the local service cluster name where Envoy is running. Though optional, it should be set if any of the following features are used: :ref:`statsd `, :ref:`health check cluster verification `, :ref:`runtime override directory `, :ref:`user agent addition `, :ref:`HTTP global rate limiting `, :ref:`CDS `, and :ref:`HTTP tracing `, either in this message or via :option:`--service-cluster`.\"\n        },\n        \"metadata\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Opaque metadata extending the node identifier. Envoy will pass this directly to the management server.\"\n        },\n        \"dynamic_parameters\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/xds.core.v3.ContextParams\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"Map from xDS resource type URL to dynamic context parameters. These may vary at runtime (unlike other fields in this message). For example, the xDS client may have a shard identifier that changes during the lifetime of the xDS client. In Envoy, this would be achieved by updating the dynamic context on the Server::Instance's LocalInfo context provider. The shard ID dynamic parameter then appears in this field during future discovery requests.\"\n        },\n        \"locality\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Locality\",\n          \"additionalProperties\": false,\n          \"description\": \"Locality specifying where the Envoy instance is running.\"\n        },\n        \"user_agent_name\": {\n          \"type\": \"string\",\n          \"description\": \"Free-form string that identifies the entity requesting config. E.g. \\\"envoy\\\" or \\\"grpc\\\"\"\n        },\n        \"user_agent_version\": {\n          \"type\": \"string\",\n          \"description\": \"Free-form string that identifies the version of the entity requesting config. E.g. \\\"1.12.2\\\" or \\\"abcd1234\\\", or \\\"SpecialEnvoyBuild\\\"\"\n        },\n        \"user_agent_build_version\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.BuildVersion\",\n          \"additionalProperties\": false,\n          \"description\": \"Structured version of the entity requesting config.\"\n        },\n        \"extensions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.Extension\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"List of extensions and their versions supported by the node.\"\n        },\n        \"client_features\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Client feature support list. These are well known features described in the Envoy API repository for a given major version of an API. Client features use reverse DNS naming scheme, for example ``com.acme.feature``. See :ref:`the list of features ` that xDS client may support.\"\n        },\n        \"listening_addresses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.Address\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Known listening ports on the node as a generic hint to the management server for filtering :ref:`listeners ` to be returned. For example, if there is a listener bound to port 80, the list can optionally contain the SocketAddress ``(0.0.0.0,80)``. The field is optional and just a hint.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Node\",\n      \"description\": \"Identifies a specific Envoy instance. The node identifier is presented to the management server, which may use this identifier to distinguish per Envoy configuration for serving. [#next-free-field: 13]\"\n    },\n    \"envoy.config.core.v3.PathConfigSource\": {\n      \"properties\": {\n        \"path\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Path on the filesystem to source and watch for configuration updates. When sourcing configuration for a :ref:`secret `, the certificate and key files are also watched for updates. .. note::  The path to the source must exist at config load time. .. note::   If ``watched_directory`` is *not* configured, Envoy will watch the file path for *moves*.   This is because in general only moves are atomic. The same method of swapping files as is   demonstrated in the :ref:`runtime documentation ` can be   used here also. If ``watched_directory`` is configured, no watch will be placed directly on   this path. Instead, the configured ``watched_directory`` will be used to trigger reloads of   this path. This is required in certain deployment scenarios. See below for more information.\"\n        },\n        \"watched_directory\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.WatchedDirectory\",\n          \"additionalProperties\": false,\n          \"description\": \"If configured, this directory will be watched for *moves*. When an entry in this directory is moved to, the ``path`` will be reloaded. This is required in certain deployment scenarios. Specifically, if trying to load an xDS resource using a `Kubernetes ConfigMap `_, the following configuration might be used: 1. Store xds.yaml inside a ConfigMap. 2. Mount the ConfigMap to ``/config_map/xds`` 3. Configure path ``/config_map/xds/xds.yaml`` 4. Configure watched directory ``/config_map/xds`` The above configuration will ensure that Envoy watches the owning directory for moves which is required due to how Kubernetes manages ConfigMap symbolic links during atomic updates.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Path Config Source\",\n      \"description\": \"Local filesystem path configuration source.\"\n    },\n    \"envoy.config.core.v3.Pipe\": {\n      \"properties\": {\n        \"path\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Unix Domain Socket path. On Linux, paths starting with '@' will use the abstract namespace. The starting '@' is replaced by a null byte by Envoy. Paths starting with '@' will result in an error in environments other than Linux.\"\n        },\n        \"mode\": {\n          \"type\": \"integer\",\n          \"description\": \"The mode for the Pipe. Not applicable for abstract sockets.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Network addresses]\",\n      \"description\": \"[#protodoc-title: Network addresses]\"\n    },\n    \"envoy.config.core.v3.ProxyProtocolConfig\": {\n      \"properties\": {\n        \"version\": {\n          \"enum\": [\n            \"V1\",\n            0,\n            \"V2\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Version\"\n        },\n        \"pass_through_tlvs\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ProxyProtocolPassThroughTLVs\",\n          \"additionalProperties\": false,\n          \"description\": \"This config controls which TLVs can be passed to upstream if it is Proxy Protocol V2 header. If there is no setting for this field, no TLVs will be passed through.\"\n        },\n        \"added_tlvs\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TlvEntry\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"This config allows additional TLVs to be included in the upstream PROXY protocol V2 header. Unlike ``pass_through_tlvs``, which passes TLVs from the downstream request, ``added_tlvs`` provides an extension mechanism for defining new TLVs that are included with the upstream request. These TLVs may not be present in the downstream request and can be defined at either the transport socket level or the host level to provide more granular control over the TLVs that are included in the upstream request. Host-level TLVs are specified in the ``metadata.typed_filter_metadata`` field under the ``envoy.transport_sockets.proxy_protocol`` namespace. .. literalinclude:: /_configs/repo/proxy_protocol.yaml    :language: yaml    :lines: 49-57    :linenos:    :lineno-start: 49    :caption: :download:`proxy_protocol.yaml </_configs/repo/proxy_protocol.yaml>` **Precedence behavior**: - When a TLV is defined at both the host level and the transport socket level, the value   from the host level configuration takes precedence. This allows users to define default TLVs   at the transport socket level and override them at the host level. - Any TLV defined in the ``pass_through_tlvs`` field will be overridden by either the host-level   or transport socket-level TLV. If there are multiple TLVs with the same type, only the TLVs from the highest precedence level will be used.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Proxy Protocol Config\"\n    },\n    \"envoy.config.core.v3.ProxyProtocolPassThroughTLVs\": {\n      \"properties\": {\n        \"match_type\": {\n          \"enum\": [\n            \"INCLUDE_ALL\",\n            0,\n            \"INCLUDE\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Pass TL Vs Match Type\"\n        },\n        \"tlv_type\": {\n          \"items\": {\n            \"type\": \"integer\"\n          },\n          \"type\": \"array\",\n          \"description\": \"The TLV types that are applied based on match_type. TLV type is defined as uint8_t in proxy protocol. See `the spec `_ for details.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Proxy protocol]\",\n      \"description\": \"[#protodoc-title: Proxy protocol]\"\n    },\n    \"envoy.config.core.v3.QuicKeepAliveSettings\": {\n      \"properties\": {\n        \"max_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The max interval for a connection to send keep-alive probing packets (with ``PING`` or ``PATH_RESPONSE``). The value should be smaller than :ref:`connection idle_timeout ` to prevent idle timeout while not less than ``1s`` to avoid throttling the connection or flooding the peer with probes. If :ref:`initial_interval ` is absent or zero, a client connection will use this value to start probing. If zero, disable keepalive probing. If absent, use the QUICHE default interval to probe.\",\n          \"format\": \"regex\"\n        },\n        \"initial_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval to send the first few keep-alive probing packets to prevent connection from hitting the idle timeout. Subsequent probes will be sent, each one with an interval exponentially longer than previous one, till it reaches :ref:`max_interval `. And the probes afterwards will always use :ref:`max_interval `. The value should be smaller than :ref:`connection idle_timeout ` to prevent idle timeout and smaller than max_interval to take effect. If absent, disable keepalive probing for a server connection. For a client connection, if :ref:`max_interval ` is zero, do not keepalive, otherwise use max_interval or QUICHE default to probe all the time.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Quic Keep Alive Settings\",\n      \"description\": \"Config for keepalive probes in a QUIC connection. .. note::   QUIC keep-alive probing packets work differently from HTTP/2 keep-alive PINGs in a sense that the probing packet   itself doesn't timeout waiting for a probing response. QUIC has a shorter idle timeout than TCP, so it doesn't rely on such probing to discover dead connections. If the peer fails to respond, the connection will idle timeout eventually. Thus, they are configured differently from :ref:`connection_keepalive `.\"\n    },\n    \"envoy.config.core.v3.QuicProtocolOptions\": {\n      \"properties\": {\n        \"max_concurrent_streams\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Maximum number of streams that the client can negotiate per connection. ``100`` if not specified.\"\n        },\n        \"initial_stream_window_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"`Initial stream-level flow-control receive window `_ size. Valid values range from ``1`` to ``16777216`` (``2^24``, maximum supported by QUICHE) and defaults to ``16777216`` (``16 * 1024 * 1024``). .. note::   ``16384`` (``2^14``) is the minimum window size supported in Google QUIC. If configured smaller than it, we will use   ``16384`` instead. QUICHE IETF QUIC implementation supports ``1`` byte window. We only support increasing the default   window size now, so it's also the minimum. This field also acts as a soft limit on the number of bytes Envoy will buffer per-stream in the QUIC stream send and receive buffers. Once the buffer reaches this pointer, watermark callbacks will fire to stop the flow of data to the stream buffers.\"\n        },\n        \"initial_connection_window_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Similar to ``initial_stream_window_size``, but for connection-level flow-control. Valid values range from ``1`` to ``25165824`` (``24MB``, maximum supported by QUICHE) and defaults to ``25165824`` (``24 * 1024 * 1024``). .. note::   ``16384`` (``2^14``) is the minimum window size supported in Google QUIC. We only support increasing the default   window size now, so it's also the minimum.\"\n        },\n        \"num_timeouts_to_trigger_port_migration\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of timeouts that can occur before port migration is triggered for QUIC clients. This defaults to ``4``. If set to ``0``, port migration will not occur on path degrading. Timeout here refers to QUIC internal path degrading timeout mechanism, such as ``PTO``. This has no effect on server sessions.\"\n        },\n        \"connection_keepalive\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.QuicKeepAliveSettings\",\n          \"additionalProperties\": false,\n          \"description\": \"Probes the peer at the configured interval to solicit traffic, i.e. ``ACK`` or ``PATH_RESPONSE``, from the peer to push back connection idle timeout. If absent, use the default keepalive behavior of which a client connection sends ``PING``s every ``15s``, and a server connection doesn't do anything.\"\n        },\n        \"connection_options\": {\n          \"type\": \"string\",\n          \"description\": \"A comma-separated list of strings representing QUIC connection options defined in `QUICHE `_ and to be sent by upstream connections.\"\n        },\n        \"client_connection_options\": {\n          \"type\": \"string\",\n          \"description\": \"A comma-separated list of strings representing QUIC client connection options defined in `QUICHE `_ and to be sent by upstream connections.\"\n        },\n        \"idle_network_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The duration that a QUIC connection stays idle before it closes itself. If this field is not present, QUICHE default ``600s`` will be applied. For internal corporate network, a long timeout is often fine. But for client facing network, ``30s`` is usually a good choice. Do not add an upper bound here. A long idle timeout is useful for maintaining warm connections at non-front-line proxy for low QPS services.\",\n          \"format\": \"regex\"\n        },\n        \"max_packet_length\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Maximum packet length for QUIC connections. It refers to the largest size of a QUIC packet that can be transmitted over the connection. If not specified, one of the `default values in QUICHE `_ is used.\"\n        },\n        \"client_packet_writer\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"A customized UDP socket and a QUIC packet writer using the socket for client connections. i.e. Mobile uses its own implementation to interact with platform socket APIs. If not present, the default platform-independent socket and writer will be used. [#extension-category: envoy.quic.client_packet_writer]\"\n        },\n        \"connection_migration\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.QuicProtocolOptions.ConnectionMigrationSettings\",\n          \"additionalProperties\": false,\n          \"description\": \"Enable QUIC `connection migration ` to a different network interface when the current network is degrading or has become bad. In order to use a different network interface other than the platform's default one, a customized :ref:`client_packet_writer ` needs to be configured to create UDP sockets on non-default networks. Only takes effect when runtime key ``envoy.reloadable_features.use_migration_in_quiche`` is true. If absent, the feature will be disabled. [#not-implemented-hide:]\"\n        },\n        \"memory_reduction_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Timeout for a QUIC connection to schedule memory reduction callback when the network has been idle for a while. This value should be smaller than the idle timeout to take effect. If not specified, memory reduction is set to infinite by QUIC connection (disabled).\",\n          \"format\": \"regex\"\n        },\n        \"enable_scone\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If true, the QUIC connection will signal support for `SCONE `_ (Standard Communication with Network Elements) and process SCONE packets. If not present, the QUICHE default behavior will be used.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Quic Protocol Options\",\n      \"description\": \"QUIC protocol options which apply to both downstream and upstream connections. [#next-free-field: 14]\"\n    },\n    \"envoy.config.core.v3.QuicProtocolOptions.ConnectionMigrationSettings\": {\n      \"properties\": {\n        \"migrate_idle_connections\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.QuicProtocolOptions.ConnectionMigrationSettings.MigrateIdleConnectionSettings\",\n          \"additionalProperties\": false,\n          \"description\": \"Config whether and how to migrate idle connections. If absent, idle connections will not be migrated but be closed upon migration signals.\"\n        },\n        \"max_time_on_non_default_network\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"After migrating to a non-default network interface, the connection will only be allowed to stay on that network for up to this period of time before being drained unless it migrates to the default network or that network gets picked as the default by the device by then. Default to 128s.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Connection Migration Settings\",\n      \"description\": \"Config for QUIC connection migration across network interfaces, i.e. cellular to WIFI, upon network change events from the platform, i.e. the current network gets disconnected, or upon the QUIC detecting a bad connection. After migration, the connection may be on a different network other than the default network picked by the platform. Both iOS and Android will use a default network to interact with the internet, usually prefer unmetered network (WIFI) over metered ones (cellular). And users can specify which network to be used as the default. A connection on non-default network is only allowed to serve new requests for a certain period of time before being drained, and meanwhile, QUIC will try to migrate to the default network if possible.\"\n    },\n    \"envoy.config.core.v3.QuicProtocolOptions.ConnectionMigrationSettings.MigrateIdleConnectionSettings\": {\n      \"properties\": {\n        \"max_idle_time_before_migration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If idle connections are allowed to be migrated, only migrate the connection if it hasn't been idle for longer than this idle period. Otherwise, the connection will be closed instead. Default to 30s.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Migrate Idle Connection Settings\",\n      \"description\": \"Config for options to migrate idle connections which aren't serving any requests.\"\n    },\n    \"envoy.config.core.v3.RateLimitSettings\": {\n      \"properties\": {\n        \"max_tokens\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Maximum number of tokens to be used for rate limiting discovery request calls. If not set, a default value of 100 will be used.\"\n        },\n        \"fill_rate\": {\n          \"additionalProperties\": false,\n          \"type\": \"number\",\n          \"description\": \"Rate at which tokens will be filled per second. If not set, a default fill rate of 10 tokens per second will be used. The minimal fill rate is once per year. Lower fill rates will be set to once per year.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Rate Limit Settings\",\n      \"description\": \"Rate Limit settings to be applied for discovery requests made by Envoy.\"\n    },\n    \"envoy.config.core.v3.RetryPolicy\": {\n      \"properties\": {\n        \"retry_back_off\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.BackoffStrategy\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies parameters that control :ref:`retry backoff strategy `. This parameter is optional, in which case the default base interval is 1000 milliseconds. The default maximum interval is 10 times the base interval.\"\n        },\n        \"num_retries\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Specifies the allowed number of retries. This parameter is optional and defaults to 1.\"\n        },\n        \"retry_on\": {\n          \"type\": \"string\",\n          \"description\": \"For details, see :ref:`retry_on `.\"\n        },\n        \"retry_priority\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RetryPolicy.RetryPriority\",\n          \"additionalProperties\": false,\n          \"description\": \"For details, see :ref:`retry_priority `.\"\n        },\n        \"retry_host_predicate\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.RetryPolicy.RetryHostPredicate\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"For details, see :ref:`RetryHostPredicate `.\"\n        },\n        \"host_selection_retry_max_attempts\": {\n          \"type\": \"string\",\n          \"description\": \"For details, see :ref:`host_selection_retry_max_attempts `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Policy\",\n      \"description\": \"The message specifies the retry policy of remote data source when fetching fails. [#next-free-field: 7]\"\n    },\n    \"envoy.config.core.v3.RetryPolicy.RetryHostPredicate\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Host Predicate\",\n      \"description\": \"See :ref:`RetryHostPredicate `.\"\n    },\n    \"envoy.config.core.v3.RetryPolicy.RetryPriority\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Priority\",\n      \"description\": \"See :ref:`RetryPriority `.\"\n    },\n    \"envoy.config.core.v3.RuntimeDouble\": {\n      \"properties\": {\n        \"default_value\": {\n          \"type\": \"number\",\n          \"description\": \"Default value if runtime value is not available.\"\n        },\n        \"runtime_key\": {\n          \"type\": \"string\",\n          \"description\": \"Runtime key to get value for comparison. This value is used if defined.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Runtime Double\",\n      \"description\": \"Runtime derived double with a default when not specified.\"\n    },\n    \"envoy.config.core.v3.RuntimeFeatureFlag\": {\n      \"properties\": {\n        \"default_value\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Default value if runtime value is not available.\"\n        },\n        \"runtime_key\": {\n          \"type\": \"string\",\n          \"description\": \"Runtime key to get value for comparison. This value is used if defined. The boolean value must be represented via its `canonical JSON encoding `_.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Runtime Feature Flag\",\n      \"description\": \"Runtime derived bool with a default when not specified.\"\n    },\n    \"envoy.config.core.v3.RuntimeUInt32\": {\n      \"properties\": {\n        \"default_value\": {\n          \"type\": \"integer\",\n          \"description\": \"Default value if runtime value is not available.\"\n        },\n        \"runtime_key\": {\n          \"type\": \"string\",\n          \"description\": \"Runtime key to get value for comparison. This value is used if defined.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Runtime U Int 32\",\n      \"description\": \"Runtime derived uint32 with a default when not specified.\"\n    },\n    \"envoy.config.core.v3.SelfConfigSource\": {\n      \"properties\": {\n        \"transport_api_version\": {\n          \"enum\": [\n            \"AUTO\",\n            0,\n            \"V2\",\n            1,\n            \"V3\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Configuration sources]\",\n          \"description\": \"[#protodoc-title: Configuration sources]  xDS API and non-xDS services version. This is used to describe both resource and transport protocol versions (in distinct configuration fields).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Self Config Source\",\n      \"description\": \"[#not-implemented-hide:] Self-referencing config source options. This is currently empty, but when set in :ref:`ConfigSource ` can be used to specify that other data can be obtained from the same server.\"\n    },\n    \"envoy.config.core.v3.SocketAddress\": {\n      \"properties\": {\n        \"protocol\": {\n          \"enum\": [\n            \"TCP\",\n            0,\n            \"UDP\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Protocol\"\n        },\n        \"address\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The address for this socket. :ref:`Listeners ` will bind to the address. An empty address is not allowed. Specify ``0.0.0.0`` or ``::`` to bind to any address. [#comment:TODO(zuercher) reinstate when implemented: It is possible to distinguish a Listener address via the prefix/suffix matching in :ref:`FilterChainMatch `.] When used within an upstream :ref:`BindConfig `, the address controls the source address of outbound connections. For :ref:`clusters `, the cluster type determines whether the address must be an IP (``STATIC`` or ``EDS`` clusters) or a hostname resolved by DNS (``STRICT_DNS`` or ``LOGICAL_DNS`` clusters). Address resolution can be customized via :ref:`resolver_name `.\"\n        },\n        \"port_value\": {\n          \"type\": \"integer\"\n        },\n        \"named_port\": {\n          \"type\": \"string\",\n          \"description\": \"This is only valid if :ref:`resolver_name ` is specified below and the named resolver is capable of named port resolution.\"\n        },\n        \"resolver_name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the custom resolver. This must have been registered with Envoy. If this is empty, a context dependent default applies. If the address is a concrete IP address, no resolution will occur. If address is a hostname this should be set for resolution other than DNS. Specifying a custom resolver with ``STRICT_DNS`` or ``LOGICAL_DNS`` will generate an error at runtime.\"\n        },\n        \"ipv4_compat\": {\n          \"type\": \"boolean\",\n          \"description\": \"When binding to an IPv6 address above, this enables `IPv4 compatibility `_. Binding to ``::`` will allow both IPv4 and IPv6 connections, with peer IPv4 addresses mapped into IPv6 space as ``::FFFF:``.\"\n        },\n        \"network_namespace_filepath\": {\n          \"type\": \"string\",\n          \"description\": \"Filepath that specifies the Linux network namespace this socket will be created in (see ``man 7 network_namespaces``). If this field is set, Envoy will create the socket in the specified network namespace. .. note::    Setting this parameter requires Envoy to run with the ``CAP_NET_ADMIN`` capability. .. attention::     Network namespaces are only configurable on Linux. Otherwise, this field has no effect.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Socket Address\",\n      \"description\": \"[#next-free-field: 8]\"\n    },\n    \"envoy.config.core.v3.SocketCmsgHeaders\": {\n      \"properties\": {\n        \"level\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"cmsg level. Default is unset.\"\n        },\n        \"type\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"cmsg type. Default is unset.\"\n        },\n        \"expected_size\": {\n          \"type\": \"integer\",\n          \"description\": \"Expected size of cmsg value. Default is zero.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Socket CMSG headers]\",\n      \"description\": \"[#protodoc-title: Socket CMSG headers]  Configuration for socket cmsg headers. See `:ref:CMSG `_ for further information.\"\n    },\n    \"envoy.config.core.v3.SocketOption\": {\n      \"properties\": {\n        \"description\": {\n          \"type\": \"string\",\n          \"description\": \"An optional name to give this socket option for debugging, etc. Uniqueness is not required and no special meaning is assumed.\"\n        },\n        \"level\": {\n          \"type\": \"string\",\n          \"description\": \"Corresponding to the level value passed to setsockopt, such as IPPROTO_TCP\"\n        },\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The numeric name as passed to setsockopt\"\n        },\n        \"int_value\": {\n          \"type\": \"string\",\n          \"description\": \"Because many sockopts take an int value.\"\n        },\n        \"buf_value\": {\n          \"type\": \"string\",\n          \"description\": \"Otherwise it's a byte buffer.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        },\n        \"state\": {\n          \"enum\": [\n            \"STATE_PREBIND\",\n            0,\n            \"STATE_BOUND\",\n            1,\n            \"STATE_LISTENING\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Socket State\"\n        },\n        \"type\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption.SocketType\",\n          \"additionalProperties\": false,\n          \"description\": \"Apply the socket option to the specified `socket type `_. If not specified, the socket option will be applied to all socket types.\"\n        },\n        \"ip_version\": {\n          \"enum\": [\n            \"SOCKET_IP_VERSION_UNSPECIFIED\",\n            0,\n            \"SOCKET_IP_VERSION_IPV4\",\n            1,\n            \"SOCKET_IP_VERSION_IPV6\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Socket Ip Version\",\n          \"description\": \"The `socket IP version `_ to apply the socket option to.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Socket option]\",\n      \"description\": \"[#protodoc-title: Socket option]  Generic socket option message. This would be used to set socket options that might not exist in upstream kernels or precompiled Envoy binaries. For example: .. code-block:: json  {    \\\"description\\\": \\\"support tcp keep alive\\\",    \\\"state\\\": 0,    \\\"level\\\": 1,    \\\"name\\\": 9,    \\\"int_value\\\": 1,  } 1 means SOL_SOCKET and 9 means SO_KEEPALIVE on Linux. With the above configuration, `TCP Keep-Alives `_ can be enabled in socket with Linux, which can be used in :ref:`listener's` or :ref:`admin's ` socket_options etc. It should be noted that the name or level may have different values on different platforms. [#next-free-field: 9]\"\n    },\n    \"envoy.config.core.v3.SocketOption.SocketType\": {\n      \"properties\": {\n        \"stream\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption.SocketType.Stream\",\n          \"additionalProperties\": false,\n          \"description\": \"Apply the socket option to the stream socket type.\"\n        },\n        \"datagram\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption.SocketType.Datagram\",\n          \"additionalProperties\": false,\n          \"description\": \"Apply the socket option to the datagram socket type.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Socket Type\",\n      \"description\": \"The `socket type `_ to apply the socket option to. Only one field should be set. If multiple fields are set, the precedence order will determine the selected one. If none of the fields is set, the socket option will be applied to all socket types. For example: If :ref:`stream ` is set, it takes precedence over :ref:`datagram `.\"\n    },\n    \"envoy.config.core.v3.SocketOption.SocketType.Datagram\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Datagram\",\n      \"description\": \"The datagram socket type.\"\n    },\n    \"envoy.config.core.v3.SocketOption.SocketType.Stream\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Stream\",\n      \"description\": \"The stream socket type.\"\n    },\n    \"envoy.config.core.v3.SocketOptionsOverride\": {\n      \"properties\": {\n        \"socket_options\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Socket Options Override\"\n    },\n    \"envoy.config.core.v3.SubstitutionFormatString\": {\n      \"properties\": {\n        \"text_format\": {\n          \"type\": \"string\",\n          \"description\": \"Specify a format with command operators to form a text string. Its details is described in :ref:`format string`. For example, setting ``text_format`` like below, .. validated-code-block:: yaml   :type-name: envoy.config.core.v3.SubstitutionFormatString   text_format: \\\"%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\\\\n\\\" generates plain text similar to: .. code-block:: text   upstream connect error:503:path=/foo Deprecated in favor of :ref:`text_format_source `. To migrate text format strings, use the :ref:`inline_string ` field.\"\n        },\n        \"json_format\": {\n          \"additionalProperties\": true,\n          \"type\": \"object\",\n          \"description\": \"Specify a format with command operators to form a JSON string. Its details is described in :ref:`format dictionary`. Values are rendered as strings, numbers, or boolean values as appropriate. Nested JSON objects may be produced by some command operators (e.g. FILTER_STATE or DYNAMIC_METADATA). See the documentation for a specific command operator for details. .. validated-code-block:: yaml   :type-name: envoy.config.core.v3.SubstitutionFormatString   json_format:     status: \\\"%RESPONSE_CODE%\\\"     message: \\\"%LOCAL_REPLY_BODY%\\\" The following JSON object would be created: .. code-block:: json  {    \\\"status\\\": 500,    \\\"message\\\": \\\"My error message\\\"  }\"\n        },\n        \"text_format_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Specify a format with command operators to form a text string. Its details is described in :ref:`format string`. For example, setting ``text_format`` like below, .. validated-code-block:: yaml   :type-name: envoy.config.core.v3.SubstitutionFormatString   text_format_source:     inline_string: \\\"%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\\\\n\\\" generates plain text similar to: .. code-block:: text   upstream connect error:503:path=/foo\"\n        },\n        \"omit_empty_values\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, when command operators are evaluated to null, * for ``text_format``, the output of the empty operator is changed from ``-`` to an   empty string, so that empty values are omitted entirely. * for ``json_format`` the keys with null values are omitted in the output structure. .. note::   This option does not work perfectly with ``json_format`` as keys with ``null`` values   will still be included in the output. See https://github.com/envoyproxy/envoy/issues/37941   for more details.\"\n        },\n        \"content_type\": {\n          \"type\": \"string\",\n          \"description\": \"Specify a ``content_type`` field. If this field is not set then ``text/plain`` is used for ``text_format`` and ``application/json`` is used for ``json_format``. .. validated-code-block:: yaml   :type-name: envoy.config.core.v3.SubstitutionFormatString   content_type: \\\"text/html; charset=UTF-8\\\"\"\n        },\n        \"formatters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a collection of Formatter plugins that can be called from the access log configuration. See the formatters extensions documentation for details. [#extension-category: envoy.formatter]\"\n        },\n        \"json_format_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.JsonFormatOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"If json_format is used, the options will be applied to the output JSON string.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Substitution Format String\",\n      \"description\": \"Configuration to use multiple :ref:`command operators ` to generate a new string in either plain text or JSON format. [#next-free-field: 8]\"\n    },\n    \"envoy.config.core.v3.TcpKeepalive\": {\n      \"properties\": {\n        \"keepalive_probes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Maximum number of keepalive probes to send without response before deciding the connection is dead. Default is to use the OS level configuration (unless overridden, Linux defaults to 9.) Setting this to ``0`` disables TCP keepalive.\"\n        },\n        \"keepalive_time\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of seconds a connection needs to be idle before keep-alive probes start being sent. Default is to use the OS level configuration (unless overridden, Linux defaults to 7200s (i.e., 2 hours.) Setting this to ``0`` disables TCP keepalive.\"\n        },\n        \"keepalive_interval\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The number of seconds between keep-alive probes. Default is to use the OS level configuration (unless overridden, Linux defaults to 75s.) Setting this to ``0`` disables TCP keepalive.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tcp Keepalive\"\n    },\n    \"envoy.config.core.v3.TlvEntry\": {\n      \"properties\": {\n        \"type\": {\n          \"type\": \"integer\",\n          \"description\": \"The type of the TLV. Must be a uint8 (0-255) as per the Proxy Protocol v2 specification.\"\n        },\n        \"value\": {\n          \"type\": \"string\",\n          \"description\": \"The static value of the TLV. Only one of ``value`` or ``format_string`` may be set.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        },\n        \"format_string\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SubstitutionFormatString\",\n          \"additionalProperties\": false,\n          \"description\": \"Uses the :ref:`format string ` to dynamically populate the TLV value from stream information. This allows dynamic values such as metadata, filter state, or other stream properties to be included in the TLV. For example: .. code-block:: yaml   type: 0xF0   format_string:     text_format_source:       inline_string: \\\"%DYNAMIC_METADATA(envoy.filters.network:key)%\\\" The formatted string will be used directly as the TLV value. Only one of ``value`` or ``format_string`` may be set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tlv Entry\",\n      \"description\": \"Represents a single Type-Length-Value (TLV) entry.\"\n    },\n    \"envoy.config.core.v3.TransportSocket\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the transport socket to instantiate. The name must match a supported transport socket implementation.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Transport Socket\",\n      \"description\": \"Configuration for transport socket in :ref:`listeners ` and :ref:`clusters `. If the configuration is empty, a default transport socket implementation and configuration will be chosen based on the platform and existence of tls_context.\"\n    },\n    \"envoy.config.core.v3.TypedExtensionConfig\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of an extension. This is not used to select the extension, instead it serves the role of an opaque identifier.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Extension configuration]\",\n      \"description\": \"[#protodoc-title: Extension configuration]  Message type for extension configuration. [#next-major-version: revisit all existing typed_config that doesn't use this wrapper.].\"\n    },\n    \"envoy.config.core.v3.UdpSocketConfig\": {\n      \"properties\": {\n        \"max_rx_datagram_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"The maximum size of received UDP datagrams. Using a larger size will cause Envoy to allocate more memory per socket. Received datagrams above this size will be dropped. If not set defaults to 1500 bytes.\"\n        },\n        \"prefer_gro\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Configures whether Generic Receive Offload (GRO) _ is preferred when reading from the UDP socket. The default is context dependent and is documented where UdpSocketConfig is used. This option affects performance but not functionality. If GRO is not supported by the operating system, non-GRO receive will be used.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: UDP socket config]\",\n      \"description\": \"[#protodoc-title: UDP socket config]  Generic UDP socket configuration.\"\n    },\n    \"envoy.config.core.v3.UpstreamHttpProtocolOptions\": {\n      \"properties\": {\n        \"auto_sni\": {\n          \"type\": \"boolean\",\n          \"description\": \"Set transport socket `SNI `_ for new upstream connections based on the downstream HTTP host/authority header or any other arbitrary header when :ref:`override_auto_sni_header ` is set, as seen by the :ref:`router filter `. Does nothing if a filter before the http router filter sets the corresponding metadata. See :ref:`SNI configuration ` for details on how this interacts with other validation options.\"\n        },\n        \"auto_san_validation\": {\n          \"type\": \"boolean\",\n          \"description\": \"Automatic validate upstream presented certificate for new upstream connections based on the downstream HTTP host/authority header or any other arbitrary header when :ref:`override_auto_sni_header ` is set, as seen by the :ref:`router filter `. This field is intended to be set with ``auto_sni`` field. Does nothing if a filter before the http router filter sets the corresponding metadata. See :ref:`validation configuration ` for how this interacts with other validation options.\"\n        },\n        \"override_auto_sni_header\": {\n          \"type\": \"string\",\n          \"description\": \"An optional alternative to the host/authority header to be used for setting the SNI value. It should be a valid downstream HTTP header, as seen by the :ref:`router filter `. If unset, host/authority header will be used for populating the SNI. If the specified header is not found or the value is empty, host/authority header will be used instead. This field is intended to be set with ``auto_sni`` and/or ``auto_san_validation`` fields. If none of these fields are set then setting this would be a no-op. Does nothing if a filter before the http router filter sets the corresponding metadata.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Upstream Http Protocol Options\"\n    },\n    \"envoy.config.core.v3.WatchedDirectory\": {\n      \"properties\": {\n        \"path\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Directory path to watch.\"\n        },\n        \"watch_modify\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, the watcher will also subscribe to file modification events (``IN_MODIFY`` on Linux) in addition to move events (``IN_MOVED_TO``). This allows in-place file writes to trigger reload callbacks. Use this when the writing process cannot use atomic rename (e.g. certain secret managers that write certificate files directly). By default, only move/rename events are watched, which is the safe choice for atomic updates (e.g. Kubernetes ConfigMap symlink swaps).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Watched Directory\",\n      \"description\": \"A directory that is watched for changes, e.g. by inotify on Linux. Move/rename events inside this directory trigger the watch.\"\n    },\n    \"envoy.config.endpoint.v3.ClusterLoadAssignment\": {\n      \"properties\": {\n        \"cluster_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Name of the cluster. This will be the :ref:`service_name ` value if specified in the cluster :ref:`EdsClusterConfig `.\"\n        },\n        \"endpoints\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.endpoint.v3.LocalityLbEndpoints\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"List of endpoints to load balance to.\"\n        },\n        \"named_endpoints\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.config.endpoint.v3.Endpoint\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"Map of named endpoints that can be referenced in LocalityLbEndpoints. [#not-implemented-hide:]\"\n        },\n        \"policy\": {\n          \"$ref\": \"#/definitions/envoy.config.endpoint.v3.ClusterLoadAssignment.Policy\",\n          \"additionalProperties\": false,\n          \"description\": \"Load balancing policy settings.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Endpoint configuration]\\n Endpoint discovery :ref:`architecture overview `\",\n      \"description\": \"[#protodoc-title: Endpoint configuration] Endpoint discovery :ref:`architecture overview `  Each route from RDS will map to a single cluster or traffic split across clusters using weights expressed in the RDS WeightedCluster. With EDS, each cluster is treated independently from a LB perspective, with LB taking place between the Localities within a cluster and at a finer granularity between the hosts within a locality. The percentage of traffic for each endpoint is determined by both its load_balancing_weight, and the load_balancing_weight of its locality. First, a locality will be selected, then an endpoint within that locality will be chose based on its weight. [#next-free-field: 6]\"\n    },\n    \"envoy.config.endpoint.v3.ClusterLoadAssignment.Policy\": {\n      \"properties\": {\n        \"drop_overloads\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.endpoint.v3.ClusterLoadAssignment.Policy.DropOverload\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Action to trim the overall incoming traffic to protect the upstream hosts. This action allows protection in case the hosts are unable to recover from an outage, or unable to autoscale or unable to handle incoming traffic volume for any reason. At the client each category is applied one after the other to generate the 'actual' drop percentage on all outgoing traffic. For example: .. code-block:: json  { \\\"drop_overloads\\\": [      { \\\"category\\\": \\\"throttle\\\", \\\"drop_percentage\\\": 60 }      { \\\"category\\\": \\\"lb\\\", \\\"drop_percentage\\\": 50 }  ]} The actual drop percentages applied to the traffic at the clients will be    \\\"throttle\\\"_drop = 60%    \\\"lb\\\"_drop = 20%  // 50% of the remaining 'actual' load, which is 40%.    actual_outgoing_load = 20% // remaining after applying all categories. Envoy supports only one element and will NACK if more than one element is present. Other xDS-capable data planes will not necessarily have this limitation. In Envoy, this ``drop_overloads`` config can be overridden by a runtime key \\\"load_balancing_policy.drop_overload_limit\\\" setting. This runtime key can be set to any integer number between 0 and 100. 0 means drop 0%. 100 means drop 100%. When both ``drop_overloads`` config and \\\"load_balancing_policy.drop_overload_limit\\\" setting are in place, the min of these two wins.\"\n        },\n        \"overprovisioning_factor\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Priority levels and localities are considered overprovisioned with this factor (in percentage). This means that we don't consider a priority level or locality unhealthy until the fraction of healthy hosts multiplied by the overprovisioning factor drops below 100. With the default value 140(1.4), Envoy doesn't consider a priority level or a locality unhealthy until their percentage of healthy hosts drops below 72%. For example: .. code-block:: json  { \\\"overprovisioning_factor\\\": 100 } Read more at :ref:`priority levels ` and :ref:`localities `.\"\n        },\n        \"endpoint_stale_after\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The max time until which the endpoints from this assignment can be used. If no new assignments are received before this time expires the endpoints are considered stale and should be marked unhealthy. Defaults to 0 which means endpoints never go stale.\",\n          \"format\": \"regex\"\n        },\n        \"weighted_priority_health\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, use the :ref:`load balancing weight ` of healthy and unhealthy hosts to determine the health of the priority level. If false, use the number of healthy and unhealthy hosts to determine the health of the priority level, or in other words assume each host has a weight of 1 for this calculation. .. note::   This is not currently implemented for   :ref:`locality weighted load balancing `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Policy\",\n      \"description\": \"Load balancing policy settings. [#next-free-field: 7]\"\n    },\n    \"envoy.config.endpoint.v3.ClusterLoadAssignment.Policy.DropOverload\": {\n      \"properties\": {\n        \"category\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Identifier for the policy specifying the drop.\"\n        },\n        \"drop_percentage\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Percentage of traffic that should be dropped for the category.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Drop Overload\"\n    },\n    \"envoy.config.endpoint.v3.Endpoint\": {\n      \"properties\": {\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Address\",\n          \"additionalProperties\": false,\n          \"description\": \"The upstream host address. .. attention::   The form of host address depends on the given cluster type. For STATIC or EDS,   it is expected to be a direct IP address (or something resolvable by the   specified :ref:`resolver `   in the Address). For LOGICAL or STRICT DNS, it is expected to be hostname,   and will be resolved via DNS.\"\n        },\n        \"health_check_config\": {\n          \"$ref\": \"#/definitions/envoy.config.endpoint.v3.Endpoint.HealthCheckConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"The optional health check configuration is used as configuration for the health checker to contact the health checked host. .. attention::   This takes into effect only for upstream clusters with   :ref:`active health checking ` enabled.\"\n        },\n        \"hostname\": {\n          \"type\": \"string\",\n          \"description\": \"The hostname associated with this endpoint. This hostname is not used for routing or address resolution. If provided, it will be associated with the endpoint, and can be used for features that require a hostname, like :ref:`auto_host_rewrite `.\"\n        },\n        \"additional_addresses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.endpoint.v3.Endpoint.AdditionalAddress\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"An ordered list of addresses that together with ``address`` comprise the list of addresses for an endpoint. The address given in the ``address`` is prepended to this list. It is assumed that the list must already be sorted by preference order of the addresses. This will only be supported for STATIC and EDS clusters.\"\n        },\n        \"observability_name\": {\n          \"type\": \"string\",\n          \"description\": \"Optional alternative stat name for this endpoint. If not specified, the main address will be used as the stat name and be extracted as ``envoy.endpoint_address`` tag value in generated stats. If specified, the ``observability_name`` here will be used to replace the main address. .. note::   This field is ignored for logical DNS host implementation.. This is useful when there are duplicate addresses in the cluster, for example when multiple endpoints share the same address but have different hostnames or metadata. In this case, the observability name can be used to differentiate between these endpoints in stats and logs.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Endpoints]\",\n      \"description\": \"[#protodoc-title: Endpoints]  Upstream host identifier. [#next-free-field: 6]\"\n    },\n    \"envoy.config.endpoint.v3.Endpoint.AdditionalAddress\": {\n      \"properties\": {\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Address\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional address that is associated with the endpoint.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Additional Address\"\n    },\n    \"envoy.config.endpoint.v3.Endpoint.HealthCheckConfig\": {\n      \"properties\": {\n        \"port_value\": {\n          \"type\": \"integer\",\n          \"description\": \"Optional alternative health check port value. By default the health check address port of an upstream host is the same as the host's serving address port. This provides an alternative health check port. Setting this with a non-zero value allows an upstream host to have different health check address port.\"\n        },\n        \"hostname\": {\n          \"type\": \"string\",\n          \"description\": \"By default, the host header for L7 health checks is controlled by cluster level configuration (see: :ref:`host ` and :ref:`authority `). Setting this to a non-empty value allows overriding the cluster level configuration for a specific endpoint.\"\n        },\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Address\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional alternative health check host address. .. attention::   The form of the health check host address is expected to be a direct IP address.\"\n        },\n        \"disable_active_health_check\": {\n          \"type\": \"boolean\",\n          \"description\": \"Optional flag to control if perform active health check for this endpoint. Active health check is enabled by default if there is a health checker.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Health Check Config\",\n      \"description\": \"The optional health check configuration.\"\n    },\n    \"envoy.config.endpoint.v3.LbEndpoint\": {\n      \"properties\": {\n        \"endpoint\": {\n          \"$ref\": \"#/definitions/envoy.config.endpoint.v3.Endpoint\",\n          \"additionalProperties\": false\n        },\n        \"endpoint_name\": {\n          \"type\": \"string\",\n          \"description\": \"[#not-implemented-hide:]\"\n        },\n        \"health_status\": {\n          \"enum\": [\n            \"UNKNOWN\",\n            0,\n            \"HEALTHY\",\n            1,\n            \"UNHEALTHY\",\n            2,\n            \"DRAINING\",\n            3,\n            \"TIMEOUT\",\n            4,\n            \"DEGRADED\",\n            5\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Health check]\\n * Health checking :ref:`architecture overview `.\\n * If health checking is configured for a cluster, additional statistics are emitted. They are\\n   documented :ref:`here `.\",\n          \"description\": \"[#protodoc-title: Health check] * Health checking :ref:`architecture overview `. * If health checking is configured for a cluster, additional statistics are emitted. They are   documented :ref:`here `.  Endpoint health status.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"The endpoint metadata specifies values that may be used by the load balancer to select endpoints in a cluster for a given request. The filter name should be specified as ``envoy.lb``. An example boolean key-value pair is ``canary``, providing the optional canary status of the upstream host. This may be matched against in a route's :ref:`RouteAction ` metadata_match field to subset the endpoints considered in cluster load balancing.\"\n        },\n        \"load_balancing_weight\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The optional load balancing weight of the upstream host; at least 1. Envoy uses the load balancing weight in some of the built in load balancers. The load balancing weight for an endpoint is divided by the sum of the weights of all endpoints in the endpoint's locality to produce a percentage of traffic for the endpoint. This percentage is then further weighted by the endpoint's locality's load balancing weight from LocalityLbEndpoints. If unspecified, will be treated as 1. The sum of the weights of all endpoints in the endpoint's locality must not exceed uint32_t maximal value (4294967295).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Lb Endpoint\",\n      \"description\": \"An Endpoint that Envoy can route traffic to. [#next-free-field: 6]\"\n    },\n    \"envoy.config.endpoint.v3.LedsClusterLocalityConfig\": {\n      \"properties\": {\n        \"leds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the source of LEDS updates for a Locality.\"\n        },\n        \"leds_collection_name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the LbEndpoint collection resource. If the name ends in ``/*``, it indicates an LbEndpoint glob collection, which is supported only in the xDS incremental protocol variants. Otherwise, it indicates an LbEndpointCollection list collection. Envoy currently supports only glob collections.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Leds Cluster Locality Config\",\n      \"description\": \"A configuration for an LEDS collection.\"\n    },\n    \"envoy.config.endpoint.v3.LocalityLbEndpoints\": {\n      \"properties\": {\n        \"locality\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Locality\",\n          \"additionalProperties\": false,\n          \"description\": \"Identifies location of where the upstream hosts run.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"Metadata to provide additional information about the locality endpoints in aggregate.\"\n        },\n        \"lb_endpoints\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.endpoint.v3.LbEndpoint\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The group of endpoints belonging to the locality specified. This is ignored if :ref:`leds_cluster_locality_config ` is set.\"\n        },\n        \"load_balancer_endpoints\": {\n          \"$ref\": \"#/definitions/envoy.config.endpoint.v3.LocalityLbEndpoints.LbEndpointList\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] Not implemented and deprecated.\"\n        },\n        \"leds_cluster_locality_config\": {\n          \"$ref\": \"#/definitions/envoy.config.endpoint.v3.LedsClusterLocalityConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"LEDS Configuration for the current locality. If this is set, the :ref:`lb_endpoints ` field is ignored.\"\n        },\n        \"load_balancing_weight\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Optional: Per priority/region/zone/sub_zone weight; at least 1. The load balancing weight for a locality is divided by the sum of the weights of all localities  at the same priority level to produce the effective percentage of traffic for the locality. The sum of the weights of all localities at the same priority level must not exceed uint32_t maximal value (4294967295). Locality weights are only considered when :ref:`locality weighted load balancing ` is configured. These weights are ignored otherwise. If no weights are specified when locality weighted load balancing is enabled, the locality is assigned no load.\"\n        },\n        \"priority\": {\n          \"type\": \"integer\",\n          \"description\": \"Optional: the priority for this LocalityLbEndpoints. If unspecified this will default to the highest priority (0). Under usual circumstances, Envoy will only select endpoints for the highest priority (0). In the event that enough endpoints for a particular priority are unavailable/unhealthy, Envoy will fail over to selecting endpoints for the next highest priority group. Read more at :ref:`priority levels `. Priorities should range from 0 (highest) to N (lowest) without skipping.\"\n        },\n        \"proximity\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Optional: Per locality proximity value which indicates how close this locality is from the source locality. This value only provides ordering information (lower the value, closer it is to the source locality). This will be consumed by load balancing schemes that need proximity order to determine where to route the requests. [#not-implemented-hide:]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Locality Lb Endpoints\",\n      \"description\": \"A group of endpoints belonging to a Locality. One can have multiple LocalityLbEndpoints for a locality, but only if they have different priorities. [#next-free-field: 10]\"\n    },\n    \"envoy.config.endpoint.v3.LocalityLbEndpoints.LbEndpointList\": {\n      \"properties\": {\n        \"lb_endpoints\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.endpoint.v3.LbEndpoint\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Lb Endpoint List\",\n      \"description\": \"[#not-implemented-hide:] A list of endpoints of a specific locality.\"\n    },\n    \"envoy.config.listener.v3.AdditionalAddress\": {\n      \"properties\": {\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Address\",\n          \"additionalProperties\": false\n        },\n        \"socket_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOptionsOverride\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional socket options that may not be present in Envoy source code or precompiled binaries. If specified, this will override the :ref:`socket_options ` in the listener. If specified with no :ref:`socket_options ` or an empty list of :ref:`socket_options `, it means no socket option will apply.\"\n        },\n        \"tcp_keepalive\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TcpKeepalive\",\n          \"additionalProperties\": false,\n          \"description\": \"Configures TCP keepalive settings for the additional address. If not set, the listener :ref:`tcp_keepalive ` configuration is inherited. You can explicitly disable TCP keepalive for the additional address by setting any keepalive field (:ref:`keepalive_probes `, :ref:`keepalive_time `, or :ref:`keepalive_interval `) to ``0``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Listener configuration]\\n Listener :ref:`configuration overview `\",\n      \"description\": \"[#protodoc-title: Listener configuration] Listener :ref:`configuration overview `  The additional address the listener is listening on.\"\n    },\n    \"envoy.config.listener.v3.ApiListener\": {\n      \"properties\": {\n        \"api_listener\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: API listener]\",\n      \"description\": \"[#protodoc-title: API listener]  Describes a type of API listener, which is used in non-proxy clients. The type of API exposed to the non-proxy application depends on the type of API listener.\"\n    },\n    \"envoy.config.listener.v3.Filter\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the filter configuration.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"config_discovery\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ExtensionConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for an extension configuration discovery service. In case of a failure and without the default configuration, the listener closes the connections.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Listener components]\\n Listener :ref:`configuration overview `\",\n      \"description\": \"[#protodoc-title: Listener components] Listener :ref:`configuration overview `  [#next-free-field: 6]\"\n    },\n    \"envoy.config.listener.v3.FilterChain\": {\n      \"properties\": {\n        \"filter_chain_match\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.FilterChainMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"The criteria to use when matching a connection to this filter chain.\"\n        },\n        \"filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.listener.v3.Filter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of individual network filters that make up the filter chain for connections established with the listener. Order matters as the filters are processed sequentially as connection events happen. Note: If the filter list is empty, the connection will close by default. For QUIC listeners, network filters other than HTTP Connection Manager (HCM) can be created, but due to differences in the connection implementation compared to TCP, the onData() method will never be called. Therefore, network filters for QUIC listeners should only expect to do work at the start of a new connection (i.e. in onNewConnection()). HCM must be the last (or only) filter in the chain.\"\n        },\n        \"use_proxy_proto\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener should expect a PROXY protocol V1 header on new connections. If this option is enabled, the listener will assume that that remote address of the connection is the one specified in the header. Some load balancers including the AWS ELB support this option. If the option is absent or set to false, Envoy will use the physical peer address of the connection as the remote address. This field is deprecated. Add a :ref:`PROXY protocol listener filter ` explicitly instead.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"Filter chain metadata.\"\n        },\n        \"transport_socket\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TransportSocket\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional custom transport socket implementation to use for downstream connections. To setup TLS, set a transport socket with name ``envoy.transport_sockets.tls`` and :ref:`DownstreamTlsContext ` in the ``typed_config``. If no transport socket configuration is specified, new connections will be set up with plaintext. [#extension-category: envoy.transport_sockets.downstream]\"\n        },\n        \"transport_socket_connect_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If present and nonzero, the amount of time to allow incoming connections to complete any transport socket negotiations. If this expires before the transport reports connection establishment, the connection is summarily closed.\",\n          \"format\": \"regex\"\n        },\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The unique name (or empty) by which this filter chain is known. .. note::     :ref:`filter_chain_matcher     `     requires that filter chains are uniquely named within a listener.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Filter Chain\",\n      \"description\": \"A filter chain wraps a set of match criteria, an option TLS context, a set of filters, and various other parameters. [#next-free-field: 10]\"\n    },\n    \"envoy.config.listener.v3.FilterChainMatch\": {\n      \"properties\": {\n        \"destination_port\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Optional destination port to consider when use_original_dst is set on the listener in determining a filter chain match.\"\n        },\n        \"prefix_ranges\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.CidrRange\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"If non-empty, an IP address and prefix length to match addresses when the listener is bound to 0.0.0.0/:: or when use_original_dst is specified.\"\n        },\n        \"address_suffix\": {\n          \"type\": \"string\",\n          \"description\": \"If non-empty, an IP address and suffix length to match addresses when the listener is bound to 0.0.0.0/:: or when use_original_dst is specified. [#not-implemented-hide:]\"\n        },\n        \"suffix_len\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"[#not-implemented-hide:]\"\n        },\n        \"direct_source_prefix_ranges\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.CidrRange\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The criteria is satisfied if the directly connected source IP address of the downstream connection is contained in at least one of the specified subnets. If the parameter is not specified or the list is empty, the directly connected source IP address is ignored.\"\n        },\n        \"source_type\": {\n          \"enum\": [\n            \"ANY\",\n            0,\n            \"SAME_IP_OR_LOOPBACK\",\n            1,\n            \"EXTERNAL\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Connection Source Type\"\n        },\n        \"source_prefix_ranges\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.CidrRange\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The criteria is satisfied if the source IP address of the downstream connection is contained in at least one of the specified subnets. If the parameter is not specified or the list is empty, the source IP address is ignored.\"\n        },\n        \"source_ports\": {\n          \"items\": {\n            \"type\": \"integer\"\n          },\n          \"type\": \"array\",\n          \"description\": \"The criteria is satisfied if the source port of the downstream connection is contained in at least one of the specified ports. If the parameter is not specified, the source port is ignored.\"\n        },\n        \"server_names\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"If non-empty, a list of server names (e.g. SNI for TLS protocol) to consider when determining a filter chain match. Those values will be compared against the server names of a new connection, when detected by one of the listener filters. The server name will be matched against all wildcard domains, i.e. ``www.example.com`` will be first matched against ``www.example.com``, then ``*.example.com``, then ``*.com``. Note that partial wildcards are not supported, and values like ``*w.example.com`` are invalid. The value ``*`` is also not supported, and ``server_names`` should be omitted instead. .. attention::   See the :ref:`FAQ entry ` on how to configure SNI for more   information.\"\n        },\n        \"transport_protocol\": {\n          \"type\": \"string\",\n          \"description\": \"If non-empty, a transport protocol to consider when determining a filter chain match. This value will be compared against the transport protocol of a new connection, when it's detected by one of the listener filters. Suggested values include: * ``raw_buffer`` - default, used when no transport protocol is detected, * ``tls`` - set by :ref:`envoy.filters.listener.tls_inspector `   when TLS protocol is detected.\"\n        },\n        \"application_protocols\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"If non-empty, a list of application protocols (e.g. ALPN for TLS protocol) to consider when determining a filter chain match. Those values will be compared against the application protocols of a new connection, when detected by one of the listener filters. Suggested values include: * ``http/1.1`` - set by :ref:`envoy.filters.listener.tls_inspector   `, * ``h2`` - set by :ref:`envoy.filters.listener.tls_inspector ` .. attention::   Currently, only :ref:`TLS Inspector ` provides   application protocol detection based on the requested   `ALPN `_ values.   However, the use of ALPN is pretty much limited to the HTTP/2 traffic on the Internet,   and matching on values other than ``h2`` is going to lead to a lot of false negatives,   unless all connecting clients are known to use ALPN.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Filter Chain Match\",\n      \"description\": \"Specifies the match criteria for selecting a specific filter chain for a listener. In order for a filter chain to be selected, *ALL* of its criteria must be fulfilled by the incoming connection, properties of which are set by the networking stack and/or listener filters. The following order applies: 1. Destination port. 2. Destination IP address. 3. Server name (e.g. SNI for TLS protocol), 4. Transport protocol. 5. Application protocols (e.g. ALPN for TLS protocol). 6. Directly connected source IP address (this will only be different from the source IP address    when using a listener filter that overrides the source address, such as the :ref:`Proxy Protocol    listener filter `). 7. Source type (e.g. any, local or external network). 8. Source IP address. 9. Source port. For criteria that allow ranges or wildcards, the most specific value in any of the configured filter chains that matches the incoming connection is going to be used (e.g. for SNI ``www.example.com`` the most specific match would be ``www.example.com``, then ``*.example.com``, then ``*.com``, then any filter chain without ``server_names`` requirements). A different way to reason about the filter chain matches: Suppose there exists N filter chains. Prune the filter chain set using the above 8 steps. In each step, filter chains which most specifically matches the attributes continue to the next step. The listener guarantees at most 1 filter chain is left after all of the steps. Example: For destination port, filter chains specifying the destination port of incoming traffic are the most specific match. If none of the filter chains specifies the exact destination port, the filter chains which do not specify ports are the most specific match. Filter chains specifying the wrong port can never be the most specific match. [#comment: Implemented rules are kept in the preference order, with deprecated fields listed at the end, because that's how we want to list them in the docs. [#comment:TODO(PiotrSikora): Add support for configurable precedence of the rules] [#next-free-field: 14]\"\n    },\n    \"envoy.config.listener.v3.Listener\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The unique name by which this listener is known. If no name is provided, Envoy will allocate an internal UUID for the listener. If the listener is to be dynamically updated or removed via :ref:`LDS ` a unique name must be provided.\"\n        },\n        \"address\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Address\",\n          \"additionalProperties\": false,\n          \"description\": \"The address that the listener should listen on. In general, the address must be unique, though that is governed by the bind rules of the OS. E.g., multiple listeners can listen on port 0 on Linux as the actual port will be allocated by the OS. Required unless ``api_listener`` or ``listener_specifier`` is populated. When the address contains a network namespace filepath (via :ref:`network_namespace_filepath `), Envoy automatically populates the filter state with key ``envoy.network.network_namespace`` when a connection is accepted. This provides read-only access to the network namespace for filters, access logs, and other components.\"\n        },\n        \"additional_addresses\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.listener.v3.AdditionalAddress\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The additional addresses the listener should listen on. The addresses must be unique across all listeners. Multiple addresses with port 0 can be supplied. When using multiple addresses in a single listener, all addresses use the same protocol, and multiple internal addresses are not supported.\"\n        },\n        \"stat_prefix\": {\n          \"type\": \"string\",\n          \"description\": \"Optional prefix to use on listener stats. If empty, the stats will be rooted at ``listener.\n.``. If non-empty, stats will be rooted at ``listener..``.\"\n        },\n        \"filter_chains\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.listener.v3.FilterChain\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of filter chains to consider for this listener. The :ref:`FilterChain ` with the most specific :ref:`FilterChainMatch ` criteria is used on a connection. Example using SNI for filter chain selection can be found in the :ref:`FAQ entry `.\"\n        },\n        \"fcds_config\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener.FcdsConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Discover filter chains configurations by external service. Dynamic discovery of filter chains is allowed while having statically configured filter chains, however, a filter chain name must be unique within a listener. If a discovered filter chain matches a name of an existing filter chain, it is discarded. [#not-implemented-hide:]\"\n        },\n        \"filter_chain_matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher\",\n          \"additionalProperties\": false,\n          \"description\": \":ref:`Matcher API ` resolving the filter chain name from the network properties. This matcher is used as a replacement for the filter chain match condition :ref:`filter_chain_match `. If specified, all :ref:`filter_chains ` must have a non-empty and unique :ref:`name ` field and not specify :ref:`filter_chain_match ` field. .. note::  Once matched, each connection is permanently bound to its filter chain.  If the matcher changes but the filter chain remains the same, the  connections bound to the filter chain are not drained. If, however, the  filter chain is removed or structurally modified, then the drain for its  connections is initiated.\"\n        },\n        \"use_original_dst\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If a connection is redirected using ``iptables``, the port on which the proxy receives it might be different from the original destination address. When this flag is set to true, the listener hands off redirected connections to the listener associated with the original destination address. If there is no listener associated with the original destination address, the connection is handled by the listener that receives it. Defaults to false.\"\n        },\n        \"default_filter_chain\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.FilterChain\",\n          \"additionalProperties\": false,\n          \"description\": \"The default filter chain if none of the filter chain matches. If no default filter chain is supplied, the connection will be closed. The filter chain match is ignored in this field.\"\n        },\n        \"per_connection_buffer_limit_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Soft limit on size of the listener\u2019s new connection read and write buffers. If unspecified, an implementation defined default is applied (1MiB).\"\n        },\n        \"per_connection_buffer_high_watermark_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Optional timeout that controls how long a connection is allowed to stay above the configured buffer high watermark before it is closed. If this timeout is not specified, or explicitly set to 0, connections will not be closed due to buffer high watermark usage.\",\n          \"format\": \"regex\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"Listener metadata. The following pre-defined metadata could be used by Envoy to manipulate the listener behavior: * ``envoy.stats_matcher``: this metadata could be used to customize the stats emitted by the   listener. See :ref:`well-known metadata ` for more   details.\"\n        },\n        \"deprecated_v1\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener.DeprecatedV1\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:]\"\n        },\n        \"drain_type\": {\n          \"enum\": [\n            \"DEFAULT\",\n            0,\n            \"MODIFY_ONLY\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Drain Type\"\n        },\n        \"listener_filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.listener.v3.ListenerFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Listener filters have the opportunity to manipulate and augment the connection metadata that is used in connection filter chain matching, for example. These filters are run before any in :ref:`filter_chains `. Order matters as the filters are processed sequentially right after a socket has been accepted by the listener, and before a connection is created. UDP Listener filters can be specified when the protocol in the listener socket address in :ref:`protocol ` is :ref:`UDP ` and no :ref:`quic_options ` is specified in :ref:`udp_listener_config `. QUIC listener filters can be specified when :ref:`quic_options ` is specified in :ref:`udp_listener_config `. They are processed sequentially right before connection creation. And like TCP Listener filters, they can be used to manipulate the connection metadata and socket. But the difference is that they can't be used to pause connection creation.\"\n        },\n        \"listener_filters_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The timeout to wait for all listener filters to complete operation. If the timeout is reached, the accepted socket is closed without a connection being created unless ``continue_on_listener_filters_timeout`` is set to true. Specify 0 to disable the timeout. If not specified, a default timeout of 15s is used.\",\n          \"format\": \"regex\"\n        },\n        \"continue_on_listener_filters_timeout\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether a connection should be created when listener filters timeout. Default is false. .. attention::   Some listener filters, such as :ref:`Proxy Protocol filter   `, should not be used with this option. It will cause   unexpected behavior when a connection is created.\"\n        },\n        \"transparent\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener should be set as a transparent socket. When this flag is set to true, connections can be redirected to the listener using an ``iptables`` ``TPROXY`` target, in which case the original source and destination addresses and ports are preserved on accepted connections. This flag should be used in combination with :ref:`an original_dst ` :ref:`listener filter ` to mark the connections' local addresses as \\\"restored.\\\" This can be used to hand off each redirected connection to another listener associated with the connection's destination address. Direct connections to the socket without using ``TPROXY`` cannot be distinguished from connections redirected using ``TPROXY`` and are therefore treated as if they were redirected. When this flag is set to false, the listener's socket is explicitly reset as non-transparent. Setting this flag requires Envoy to run with the ``CAP_NET_ADMIN`` capability. When this flag is not set (default), the socket is not modified, i.e. the transparent option is neither set nor reset.\"\n        },\n        \"freebind\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener should set the ``IP_FREEBIND`` socket option. When this flag is set to true, listeners can be bound to an IP address that is not configured on the system running Envoy. When this flag is set to false, the option ``IP_FREEBIND`` is disabled on the socket. When this flag is not set (default), the socket is not modified, i.e. the option is neither enabled nor disabled.\"\n        },\n        \"socket_options\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.SocketOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Additional socket options that may not be present in Envoy source code or precompiled binaries. It is not allowed to update the socket options for any existing address if :ref:`enable_reuse_port ` is ``false`` to avoid the conflict when creating new sockets for the listener.\"\n        },\n        \"tcp_fast_open_queue_length\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Whether the listener should accept TCP Fast Open (TFO) connections. When this flag is set to a value greater than 0, the option TCP_FASTOPEN is enabled on the socket, with a queue length of the specified size (see `details in RFC7413 `_). When this flag is set to 0, the option TCP_FASTOPEN is disabled on the socket. When this flag is not set (default), the socket is not modified, i.e. the option is neither enabled nor disabled. On Linux, the net.ipv4.tcp_fastopen kernel parameter must include flag 0x2 to enable TCP_FASTOPEN. See `ip-sysctl.txt `_. On macOS, only values of 0, 1, and unset are valid; other values may result in an error. To set the queue length on macOS, set the net.inet.tcp.fastopen_backlog kernel parameter.\"\n        },\n        \"traffic_direction\": {\n          \"enum\": [\n            \"UNSPECIFIED\",\n            0,\n            \"INBOUND\",\n            1,\n            \"OUTBOUND\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Traffic Direction\",\n          \"description\": \"Identifies the direction of the traffic relative to the local Envoy.\"\n        },\n        \"udp_listener_config\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.UdpListenerConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"If the protocol in the listener socket address in :ref:`protocol ` is :ref:`UDP `, this field specifies UDP listener specific configuration.\"\n        },\n        \"api_listener\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.ApiListener\",\n          \"additionalProperties\": false,\n          \"description\": \"Used to represent an API listener, which is used in non-proxy clients. The type of API exposed to the non-proxy application depends on the type of API listener. When this field is set, no other field except for :ref:`name` should be set. .. note::  Currently only one ApiListener can be installed; and it can only be done via bootstrap config,  not LDS. [#next-major-version: In the v3 API, instead of this messy approach where the socket listener fields are directly in the top-level Listener message and the API listener types are in the ApiListener message, the socket listener messages should be in their own message, and the top-level Listener should essentially be a oneof that selects between the socket listener and the various types of API listener. That way, a given Listener message can structurally only contain the fields of the relevant type.]\"\n        },\n        \"connection_balance_config\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener.ConnectionBalanceConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"The listener's connection balancer configuration, currently only applicable to TCP listeners. If no configuration is specified, Envoy will not attempt to balance active connections between worker threads. In the scenario that the listener X redirects all the connections to the listeners Y1 and Y2 by setting :ref:`use_original_dst ` in X and :ref:`bind_to_port ` to false in Y1 and Y2, it is recommended to disable the balance config in listener X to avoid the cost of balancing, and enable the balance config in Y1 and Y2 to balance the connections among the workers.\"\n        },\n        \"reuse_port\": {\n          \"type\": \"boolean\",\n          \"description\": \"Deprecated. Use ``enable_reuse_port`` instead.\"\n        },\n        \"enable_reuse_port\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"When this flag is set to true, listeners set the ``SO_REUSEPORT`` socket option and create one socket for each worker thread. This makes inbound connections distribute among worker threads roughly evenly in cases where there are a high number of connections. When this flag is set to false, all worker threads share one socket. This field defaults to true. The change of field will be rejected during an listener update when the runtime flag ``envoy.reloadable_features.enable_update_listener_socket_options`` is enabled. Otherwise, the update of this field will be ignored quietly. .. attention::   Although this field defaults to true, it has different behavior on different platforms. See   the following text for more information. * On Linux, reuse_port is respected for both TCP and UDP listeners. It also works correctly   with hot restart. * On macOS, reuse_port for TCP does not do what it does on Linux. Instead of load balancing,   the last socket wins and receives all connections/packets. For TCP, reuse_port is force   disabled and the user is warned. For UDP, it is enabled, but only one worker will receive   packets. For QUIC/H3, SW routing will send packets to other workers. For \\\"raw\\\" UDP, only   a single worker will currently receive packets. * On Windows, reuse_port for TCP has undefined behavior. It is force disabled and the user   is warned similar to macOS. It is left enabled for UDP with undefined behavior currently.\"\n        },\n        \"access_log\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLog\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration for :ref:`access logs ` emitted by this listener.\"\n        },\n        \"tcp_backlog_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum length a tcp listener's pending connections queue can grow to. If no value is provided net.core.somaxconn will be used on Linux and 128 otherwise.\"\n        },\n        \"max_connections_to_accept_per_socket_event\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of connections to accept from the kernel per socket event. Envoy may decide to close these connections after accepting them from the kernel e.g. due to load shedding, or other policies. If there are more than max_connections_to_accept_per_socket_event connections pending accept, connections over this threshold will be accepted in later event loop iterations. If no value is provided Envoy will accept all connections pending accept from the kernel. .. note::  It is recommended to lower this value for better overload management and reduced per-event cost.  Setting it to 1 is a viable option with no noticeable impact on performance.\"\n        },\n        \"bind_to_port\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener should bind to the port. A listener that doesn't bind can only receive connections redirected from other listeners that set :ref:`use_original_dst ` to true. Default is true.\"\n        },\n        \"internal_listener\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener.InternalListenerConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Used to represent an internal listener which does not listen on OSI L4 address but can be used by the :ref:`envoy cluster ` to create a user space connection to. The internal listener acts as a TCP listener. It supports listener filters and network filter chains. Upstream clusters refer to the internal listeners by their :ref:`name `. :ref:`Address ` must not be set on the internal listeners. There are some limitations that are derived from the implementation. The known limitations include: * :ref:`ConnectionBalanceConfig ` is not   allowed because both the cluster connection and the listener connection must be owned by the same dispatcher. * :ref:`tcp_backlog_size ` * :ref:`freebind ` * :ref:`transparent `\"\n        },\n        \"enable_mptcp\": {\n          \"type\": \"boolean\",\n          \"description\": \"Enable MPTCP (multi-path TCP) on this listener. Clients will be allowed to establish MPTCP connections. Non-MPTCP clients will fall back to regular TCP.\"\n        },\n        \"ignore_global_conn_limit\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener should limit connections based upon the value of :ref:`global_downstream_max_connections `.\"\n        },\n        \"bypass_overload_manager\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener bypasses configured overload manager actions.\"\n        },\n        \"tcp_keepalive\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TcpKeepalive\",\n          \"additionalProperties\": false,\n          \"description\": \"If set, TCP keepalive settings are configured for the listener address and inherited by additional addresses. If not set, TCP keepalive settings are not configured for the listener address and additional addresses by default. See :ref:`tcp_keepalive ` to explicitly configure TCP keepalive settings for individual additional addresses.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Listener\",\n      \"description\": \"[#next-free-field: 39]\"\n    },\n    \"envoy.config.listener.v3.Listener.ConnectionBalanceConfig\": {\n      \"properties\": {\n        \"exact_balance\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener.ConnectionBalanceConfig.ExactBalance\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, the listener will use the exact connection balancer.\"\n        },\n        \"extend_balance\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"The listener will use the connection balancer according to ``type_url``. If ``type_url`` is invalid, Envoy will not attempt to balance active connections between worker threads. The ``envoy.network.connection_balance`` extension category is currently empty because the only registered member (``envoy.network.connection_balance.dlb``) is disabled. See https://github.com/envoyproxy/envoy/issues/45491.\"\n        },\n        \"cpu_locality_balance\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.Listener.ConnectionBalanceConfig.CpuLocalityBalance\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, the listener will steer new connections to worker threads using a kernel ``SO_REUSEPORT`` BPF program. See :ref:`CpuLocalityBalance ` for the requirements and fallback behavior.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Connection Balance Config\",\n      \"description\": \"Configuration for listener connection balancing.\"\n    },\n    \"envoy.config.listener.v3.Listener.ConnectionBalanceConfig.CpuLocalityBalance\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cpu Locality Balance\",\n      \"description\": \"A connection balancer that steers each new TCP connection to the worker thread pinned to the CPU that received the connection, using a kernel ``SO_REUSEPORT`` BPF program. This removes the lock that the :ref:`exact balancer ` takes on every accept and keeps each connection on a single worker for cache and ``NUMA`` locality. To realize locality the operator should align ``NIC`` receive steering so connections arrive on the worker CPUs, for example with receive side scaling or ``IRQ`` affinity. It is available on Linux only and requires :ref:`enable_worker_cpu_affinity ` so worker ``i`` is pinned to the CPU the program steers to it, :ref:`enable_reuse_port `, a kernel that supports reuse port BPF steering, and a worker count no greater than the number of CPUs in the process affinity mask. When any of these is not met, or if the kernel rejects the steering program at runtime, the listener keeps serving with the kernel default reuse port hashing and without CPU locality. Worker affinity is fixed when the worker threads start, so a listener added dynamically via LDS steers with the same mapping. During a hot restart new connections may be steered to the draining parent process until it exits.\"\n    },\n    \"envoy.config.listener.v3.Listener.ConnectionBalanceConfig.ExactBalance\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Exact Balance\",\n      \"description\": \"A connection balancer implementation that does exact balancing. This means that a lock is held during balancing so that connection counts are nearly exactly balanced between worker threads. This is \\\"nearly\\\" exact in the sense that a connection might close in parallel thus making the counts incorrect, but this should be rectified on the next accept. This balancer sacrifices accept throughput for accuracy and should be used when there are a small number of connections that rarely cycle (e.g., service mesh gRPC egress).\"\n    },\n    \"envoy.config.listener.v3.Listener.DeprecatedV1\": {\n      \"properties\": {\n        \"bind_to_port\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the listener should bind to the port. A listener that doesn't bind can only receive connections redirected from other listeners that set use_original_dst parameter to true. Default is true. This is deprecated. Use :ref:`Listener.bind_to_port `\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Deprecated V 1\",\n      \"description\": \"[#not-implemented-hide:]\"\n    },\n    \"envoy.config.listener.v3.Listener.FcdsConfig\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"Optional name to present to the filter chain discovery service. This may be an arbitrary name with arbitrary length. If a name is not provided, the listener's name is used. Refer to :ref:`filter_chains `. for details on how listener name is determined if unspecified. In addition, this may be a xdstp:// URL.\"\n        },\n        \"config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the source of FCDS updates for this listener. .. note::   This discovery service only supports ``AGGREGATED_GRPC`` API type.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Fcds Config\",\n      \"description\": \"Configuration for filter chains discovery. [#not-implemented-hide:]\"\n    },\n    \"envoy.config.listener.v3.Listener.InternalListenerConfig\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Internal Listener Config\",\n      \"description\": \"Configuration for envoy internal listener. All the future internal listener features should be added here.\"\n    },\n    \"envoy.config.listener.v3.ListenerFilter\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the filter configuration.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"config_discovery\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ExtensionConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for an extension configuration discovery service. In case of a failure and without the default configuration, the listener closes the connections.\"\n        },\n        \"filter_disabled\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.ListenerFilterChainMatchPredicate\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional match predicate used to disable the filter. The filter is enabled when this field is empty. See :ref:`ListenerFilterChainMatchPredicate ` for further examples.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Listener Filter\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.config.listener.v3.ListenerFilterChainMatchPredicate\": {\n      \"properties\": {\n        \"or_match\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.ListenerFilterChainMatchPredicate.MatchSet\",\n          \"additionalProperties\": false,\n          \"description\": \"A set that describes a logical OR. If any member of the set matches, the match configuration matches.\"\n        },\n        \"and_match\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.ListenerFilterChainMatchPredicate.MatchSet\",\n          \"additionalProperties\": false,\n          \"description\": \"A set that describes a logical AND. If all members of the set match, the match configuration matches.\"\n        },\n        \"not_match\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.ListenerFilterChainMatchPredicate\",\n          \"additionalProperties\": false,\n          \"description\": \"A negation match. The match configuration will match if the negated match condition matches.\"\n        },\n        \"any_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"The match configuration will always match.\"\n        },\n        \"destination_port_range\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Int32Range\",\n          \"additionalProperties\": false,\n          \"description\": \"Match destination port. Particularly, the match evaluation must use the recovered local port if the owning listener filter is after :ref:`an original_dst listener filter `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Listener Filter Chain Match Predicate\",\n      \"description\": \"Listener filter chain match configuration. This is a recursive structure which allows complex nested match configurations to be built using various logical operators. Examples: * Matches if the destination port is 3306. .. code-block:: yaml  destination_port_range:   start: 3306   end: 3307 * Matches if the destination port is 3306 or 15000. .. code-block:: yaml  or_match:    rules:      - destination_port_range:          start: 3306          end: 3307      - destination_port_range:          start: 15000          end: 15001 [#next-free-field: 6]\"\n    },\n    \"envoy.config.listener.v3.ListenerFilterChainMatchPredicate.MatchSet\": {\n      \"properties\": {\n        \"rules\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.listener.v3.ListenerFilterChainMatchPredicate\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The list of rules that make up the set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Match Set\",\n      \"description\": \"A set of match configurations used for logical operations.\"\n    },\n    \"envoy.config.listener.v3.QuicProtocolOptions\": {\n      \"properties\": {\n        \"quic_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.QuicProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"idle_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Maximum number of milliseconds that connection will be alive when there is no network activity. If it is less than 1ms, Envoy will use 1ms. 300000ms if not specified.\",\n          \"format\": \"regex\"\n        },\n        \"crypto_handshake_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Connection timeout in milliseconds before the crypto handshake is finished. If it is less than 5000ms, Envoy will use 5000ms. 20000ms if not specified.\",\n          \"format\": \"regex\"\n        },\n        \"enabled\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeFeatureFlag\",\n          \"additionalProperties\": false,\n          \"description\": \"Runtime flag that controls whether the listener is enabled or not. If not specified, defaults to enabled.\"\n        },\n        \"packets_to_read_to_connection_count_ratio\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"A multiplier to number of connections which is used to determine how many packets to read per event loop. A reasonable number should allow the listener to process enough payload but not starve TCP and other UDP sockets and also prevent long event loop duration. The default value is 32. This means if there are N QUIC connections, the total number of packets to read in each read event will be 32 * N. The actual number of packets to read in total by the UDP listener is also bound by 6000, regardless of this field or how many connections there are.\"\n        },\n        \"crypto_stream_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configure which implementation of ``quic::QuicCryptoClientStreamBase`` to be used for this listener. If not specified the :ref:`QUICHE default one configured by ` will be used. [#extension-category: envoy.quic.server.crypto_stream]\"\n        },\n        \"proof_source_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configure which implementation of ``quic::ProofSource`` to be used for this listener. If not specified the :ref:`default one configured by ` will be used. [#extension-category: envoy.quic.proof_source]\"\n        },\n        \"connection_id_generator_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Config which implementation of ``quic::ConnectionIdGeneratorInterface`` to be used for this listener. If not specified the :ref:`default one configured by ` will be used. [#extension-category: envoy.quic.connection_id_generator]\"\n        },\n        \"server_preferred_address_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configure the server's preferred address to advertise so that client can migrate to it. See :ref:`example ` which configures a pair of v4 and v6 preferred addresses. The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with. If not specified, Envoy will not advertise any server's preferred address. [#extension-category: envoy.quic.server_preferred_address]\"\n        },\n        \"send_disable_active_migration\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Configure the server to send transport parameter `disable_active_migration `_. Defaults to false (do not send this transport parameter).\"\n        },\n        \"connection_debug_visitor_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configure which implementation of ``quic::QuicConnectionDebugVisitor`` to be used for this listener. If not specified, no debug visitor will be attached to connections. [#extension-category: envoy.quic.connection_debug_visitor]\"\n        },\n        \"save_cmsg_config\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.SocketCmsgHeaders\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configure a type of UDP cmsg to pass to listener filters via QuicReceivedPacket. Both level and type must be specified for cmsg to be saved. Cmsg may be truncated or omitted if expected size is not set. If not specified, no cmsg will be saved to QuicReceivedPacket.\"\n        },\n        \"reject_new_connections\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the listener will reject connection-establishing packets at the QUIC layer by replying with an empty version negotiation packet to the client.\"\n        },\n        \"max_sessions_per_event_loop\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Maximum number of QUIC sessions to create per event loop. If not specified, the default value is 16. This is an equivalent of the TCP listener option max_connections_to_accept_per_socket_event.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: QUIC listener config]\",\n      \"description\": \"[#protodoc-title: QUIC listener config]  Configuration specific to the UDP QUIC listener. [#next-free-field: 15]\"\n    },\n    \"envoy.config.listener.v3.UdpListenerConfig\": {\n      \"properties\": {\n        \"downstream_socket_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.UdpSocketConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"UDP socket configuration for the listener. The default for :ref:`prefer_gro ` is false for listener sockets. If receiving a large amount of datagrams from a small number of sources, it may be worthwhile to enable this option after performance testing.\"\n        },\n        \"quic_options\": {\n          \"$ref\": \"#/definitions/envoy.config.listener.v3.QuicProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for QUIC protocol. If empty, QUIC will not be enabled on this listener. Set to the default object to enable QUIC without modifying any additional options.\"\n        },\n        \"udp_packet_packet_writer_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for the UDP packet writer. If empty, HTTP/3 will use GSO if available (:ref:`UdpDefaultWriterFactory `) or the default kernel sendmsg if not, (:ref:`UdpDefaultWriterFactory `) and raw UDP will use kernel sendmsg. [#extension-category: envoy.udp_packet_writer]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: UDP listener config]\\n Listener :ref:`configuration overview `\",\n      \"description\": \"[#protodoc-title: UDP listener config] Listener :ref:`configuration overview `  [#next-free-field: 9]\"\n    },\n    \"envoy.config.metrics.v3.HistogramBucketSettings\": {\n      \"properties\": {\n        \"match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The stats that this rule applies to. The match is applied to the original stat name before tag-extraction, for example ``cluster.exampleclustername.upstream_cx_length_ms``.\"\n        },\n        \"buckets\": {\n          \"items\": {\n            \"type\": \"number\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Each value is the upper bound of a bucket. Each bucket must be greater than 0 and unique. The order of the buckets does not matter.\"\n        },\n        \"bins\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Initial number of bins for the ``circllhist`` thread local histogram per time series. Default value is 100.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Histogram Bucket Settings\",\n      \"description\": \"Specifies a matcher for stats and the buckets that matching stats should use.\"\n    },\n    \"envoy.config.metrics.v3.StatsConfig\": {\n      \"properties\": {\n        \"stats_tags\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.metrics.v3.TagSpecifier\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Each stat name is independently processed through these tag specifiers. When a tag is matched, the first capture group is not immediately removed from the name, so later :ref:`TagSpecifiers ` can also match that same portion of the match. After all tag matching is complete, a tag-extracted version of the name is produced and is used in stats sinks that represent tags, such as Prometheus.\"\n        },\n        \"use_all_default_tags\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Use all default tag regexes specified in Envoy. These can be combined with custom tags specified in :ref:`stats_tags `. They will be processed before the custom tags. See :repo:`well_known_names.h ` for a list of the default tags in Envoy. If not provided, the value is assumed to be true.\"\n        },\n        \"stats_matcher\": {\n          \"$ref\": \"#/definitions/envoy.config.metrics.v3.StatsMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Inclusion/exclusion matcher for stat name creation. If not provided, all stats are instantiated as normal. Preventing the instantiation of certain families of stats can improve memory performance for Envoys running especially large configs. .. warning::   Excluding stats may affect Envoy's behavior in undocumented ways. See   `issue #8771 `_ for more information.   If any unexpected behavior changes are observed, please open a new issue immediately.\"\n        },\n        \"histogram_bucket_settings\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.metrics.v3.HistogramBucketSettings\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Defines rules for setting the histogram buckets. Rules are evaluated in order, and the first match is applied. If no match is found (or if no rules are set), the following default buckets are used:   .. code-block:: json     [       0.5,       1,       5,       10,       25,       50,       100,       250,       500,       1000,       2500,       5000,       10000,       30000,       60000,       300000,       600000,       1800000,       3600000     ]\"\n        },\n        \"allow_default_tag_overrides\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"When set to ``true``, tag extractors specified in :ref:`stats_tags ` take precedence over the built-in default tag extractors that share the same ``tag_name``, instead of the default taking precedence. This allows overriding individual default Envoy tags (for example ``envoy.cluster_name``) while keeping :ref:`use_all_default_tags ` enabled, so it is not necessary to disable all defaults and re-declare every extractor. Has no effect when ``use_all_default_tags`` is ``false`` (no default extractors are added in that case). If not provided, the value is assumed to be false, preserving existing behavior where the default extractor takes precedence over custom extractors with the same ``tag_name``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Stats Config\",\n      \"description\": \"Statistics configuration such as tagging. [#next-free-field: 6]\"\n    },\n    \"envoy.config.metrics.v3.StatsMatcher\": {\n      \"properties\": {\n        \"reject_all\": {\n          \"type\": \"boolean\",\n          \"description\": \"If ``reject_all`` is true, then all stats are disabled. If ``reject_all`` is false, then all stats are enabled.\"\n        },\n        \"exclusion_list\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.ListStringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Exclusive match. All stats are enabled except for those matching one of the supplied StringMatcher protos.\"\n        },\n        \"inclusion_list\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.ListStringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Inclusive match. No stats are enabled except for those matching one of the supplied StringMatcher protos.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Stats Matcher\",\n      \"description\": \"Configuration for disabling stat instantiation.  The instantiation of stats is unrestricted by default. If the goal is to configure Envoy to instantiate all stats, there is no need to construct a StatsMatcher. However, StatsMatcher can be used to limit the creation of families of stats in order to conserve memory. Stats can either be disabled entirely, or they can be limited by either an exclusion or an inclusion list of :ref:`StringMatcher ` protos: * If ``reject_all`` is set to ``true``, no stats will be instantiated. If ``reject_all`` is set to   ``false``, all stats will be instantiated. * If an exclusion list is supplied, any stat name matching *any* of the StringMatchers in the   list will not instantiate. * If an inclusion list is supplied, no stats will instantiate, except those matching *any* of   the StringMatchers in the list. A StringMatcher can be used to match against an exact string, a suffix / prefix, or a regex. **NB:** For performance reasons, it is highly recommended to use a prefix- or suffix-based matcher rather than a regex-based matcher. Example 1. Excluding all stats. .. code-block:: json   {     \\\"statsMatcher\\\": {       \\\"rejectAll\\\": \\\"true\\\"     }   } Example 2. Excluding all cluster-specific stats, but not cluster-manager stats: .. code-block:: json   {     \\\"statsMatcher\\\": {       \\\"exclusionList\\\": {         \\\"patterns\\\": [           {             \\\"prefix\\\": \\\"cluster.\\\"           }         ]       }     }   } Example 3. Including only manager-related stats: .. code-block:: json   {     \\\"statsMatcher\\\": {       \\\"inclusionList\\\": {         \\\"patterns\\\": [           {             \\\"prefix\\\": \\\"cluster_manager.\\\"           },           {             \\\"prefix\\\": \\\"listener_manager.\\\"           }         ]       }     }   }\"\n    },\n    \"envoy.config.metrics.v3.StatsSink\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the stats sink to instantiate. The name must match a supported stats sink. See the :ref:`extensions listed in typed_config below ` for the default list of available stats sink. Sinks optionally support tagged/multiple dimensional metrics.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Stats]\\n Statistics :ref:`architecture overview `.\",\n      \"description\": \"[#protodoc-title: Stats] Statistics :ref:`architecture overview `.  Configuration for pluggable stats sinks.\"\n    },\n    \"envoy.config.metrics.v3.TagSpecifier\": {\n      \"properties\": {\n        \"tag_name\": {\n          \"type\": \"string\",\n          \"description\": \"Attaches an identifier to the tag values to identify the tag being in the sink. Envoy has a set of default names and regexes to extract dynamic portions of existing stats, which can be found in :repo:`well_known_names.h ` in the Envoy repository. If a :ref:`tag_name ` is provided in the config and neither :ref:`regex ` or :ref:`fixed_value ` were specified, Envoy will attempt to find that name in its set of defaults and use the accompanying regex. .. note::   A stat name may be spelled in such a way that it matches two different   tag extractors for the same tag name. In that case, all but one of the   tag values will be dropped. It is not specified which tag value will be   retained. The extraction will only occur for one of the extractors, and   only the matched extraction will be removed from the tag name.\"\n        },\n        \"regex\": {\n          \"type\": \"string\",\n          \"description\": \"Designates a tag to strip from the tag extracted name and provide as a named tag value for all statistics. This will only occur if any part of the name matches the regex provided with one or more capture groups. The first capture group identifies the portion of the name to remove. The second capture group (which will normally be nested inside the first) will designate the value of the tag for the statistic. If no second capture group is provided, the first will also be used to set the value of the tag. All other capture groups will be ignored. Example 1. a stat name ``cluster.foo_cluster.upstream_rq_timeout`` and one tag specifier: .. code-block:: json   {     \\\"tag_name\\\": \\\"envoy.cluster_name\\\",     \\\"regex\\\": \\\"^cluster\\\\\\\\.((.+?)\\\\\\\\.)\\\"   } Note that the regex will remove ``foo_cluster.`` making the tag extracted name ``cluster.upstream_rq_timeout`` and the tag value for ``envoy.cluster_name`` will be ``foo_cluster`` (note: there will be no ``.`` character because of the second capture group). Example 2. a stat name ``http.connection_manager_1.user_agent.ios.downstream_cx_total`` and two tag specifiers: .. code-block:: json   [     {       \\\"tag_name\\\": \\\"envoy.http_user_agent\\\",       \\\"regex\\\": \\\"^http(?=\\\\\\\\.).*?\\\\\\\\.user_agent\\\\\\\\.((.+?)\\\\\\\\.)\\\\\\\\w+?$\\\"     },     {       \\\"tag_name\\\": \\\"envoy.http_conn_manager_prefix\\\",       \\\"regex\\\": \\\"^http\\\\\\\\.((.*?)\\\\\\\\.)\\\"     }   ] The two regexes of the specifiers will be processed from the elaborated stat name. The first regex will save ``ios.`` as the tag value for ``envoy.http_user_agent``. It will leave it in the name for potential matching with additional tag specifiers. After all tag specifiers are processed the tags will be removed from the name. The second regex will populate tag ``envoy.http_conn_manager_prefix`` with value ``connection_manager_1.``, based on the original stat name. As a final step, the matched tags are removed, leaving ``http.user_agent.downstream_cx_total`` as the tag extracted name.\"\n        },\n        \"fixed_value\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies a fixed tag value for the ``tag_name``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tag Specifier\",\n      \"description\": \"Designates a tag name and value pair. The value may be either a fixed value or a regex providing the value via capture groups. The specified tag will be unconditionally set if a fixed value, otherwise it will only be set if one or more capture groups in the regex match.\"\n    },\n    \"envoy.config.overload.v3.BufferFactoryConfig\": {\n      \"properties\": {\n        \"minimum_account_to_track_power_of_two\": {\n          \"type\": \"integer\",\n          \"description\": \"The minimum power of two at which Envoy starts tracking an account. Envoy has 8 power of two buckets starting with the provided exponent below. Concretely the 1st bucket contains accounts for streams that use [2^minimum_account_to_track_power_of_two, 2^(minimum_account_to_track_power_of_two + 1)) bytes. With the 8th bucket tracking accounts >= 128 * 2^minimum_account_to_track_power_of_two. The maximum value is 56, since we're using uint64_t for bytes counting, and that's the last value that would use the 8 buckets. In practice, we don't expect the proxy to be holding 2^56 bytes. If omitted, Envoy should not do any tracking.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Buffer Factory Config\",\n      \"description\": \"Configuration for which accounts the WatermarkBuffer Factories should track.\"\n    },\n    \"envoy.config.overload.v3.LoadShedPoint\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"This is just a well-known string for the LoadShedPoint. Deployment specific LoadShedPoints e.g. within a custom extension should be prefixed by the company / deployment name to avoid colliding with any open source LoadShedPoints.\"\n        },\n        \"triggers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.overload.v3.Trigger\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A set of triggers for this LoadShedPoint. The LoadShedPoint will use the the maximum state of all triggers, which can be scalar values between 0 and 1 or saturated. A LoadShedPoint can only have one trigger for a given resource e.g. :ref:`Trigger.name ` must be unique in this list.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Load Shed Point\",\n      \"description\": \"A point within the connection or request lifecycle that provides context on whether to shed load at that given stage for the current entity at the point.\"\n    },\n    \"envoy.config.overload.v3.OverloadAction\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the overload action. This is just a well-known string that listeners can use for registering callbacks. Valid known overload actions include: - envoy.overload_actions.stop_accepting_requests - envoy.overload_actions.disable_http_keepalive - envoy.overload_actions.stop_accepting_connections - envoy.overload_actions.reject_incoming_connections - envoy.overload_actions.shrink_heap - envoy.overload_actions.reduce_timeouts - envoy.overload_actions.reset_high_memory_stream\"\n        },\n        \"triggers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.overload.v3.Trigger\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A set of triggers for this action. The state of the action is the maximum state of all triggers, which can be scalar values between 0 and 1 or saturated. Listeners are notified when the overload action changes state. An overload manager action can only have one trigger for a given resource e.g. :ref:`Trigger.name ` must be unique in this list.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Overload Action\"\n    },\n    \"envoy.config.overload.v3.OverloadManager\": {\n      \"properties\": {\n        \"refresh_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval for refreshing resource usage.\",\n          \"format\": \"regex\"\n        },\n        \"resource_monitors\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.overload.v3.ResourceMonitor\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The set of resources to monitor.\"\n        },\n        \"actions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.overload.v3.OverloadAction\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The set of overload actions.\"\n        },\n        \"loadshed_points\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.overload.v3.LoadShedPoint\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The set of load shed points.\"\n        },\n        \"buffer_factory_config\": {\n          \"$ref\": \"#/definitions/envoy.config.overload.v3.BufferFactoryConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for buffer factory.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Overload Manager\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.config.overload.v3.ResourceMonitor\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the resource monitor to instantiate. Must match a registered resource monitor type. See the :ref:`extensions listed in typed_config below ` for the default list of available resource monitor.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"The Overload Manager provides an extensible framework to protect Envoy instances\\n from overload of various resources (memory, cpu, file descriptors, etc).\\n It monitors a configurable set of resources and notifies registered listeners\\n when triggers related to those resources fire.\",\n      \"description\": \"[#protodoc-title: Overload Manager]  The Overload Manager provides an extensible framework to protect Envoy instances from overload of various resources (memory, cpu, file descriptors, etc). It monitors a configurable set of resources and notifies registered listeners when triggers related to those resources fire.\"\n    },\n    \"envoy.config.overload.v3.ScaledTrigger\": {\n      \"properties\": {\n        \"scaling_threshold\": {\n          \"type\": \"number\",\n          \"description\": \"If the resource pressure is greater than this value, the trigger will be in the :ref:`scaling ` state with value ``(pressure - scaling_threshold) / (saturation_threshold - scaling_threshold)``.\"\n        },\n        \"saturation_threshold\": {\n          \"type\": \"number\",\n          \"description\": \"If the resource pressure is greater than this value, the trigger will enter saturation.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Scaled Trigger\"\n    },\n    \"envoy.config.overload.v3.ThresholdTrigger\": {\n      \"properties\": {\n        \"value\": {\n          \"type\": \"number\",\n          \"description\": \"If the resource pressure is greater than or equal to this value, the trigger will enter saturation.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Threshold Trigger\"\n    },\n    \"envoy.config.overload.v3.Trigger\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the resource this is a trigger for.\"\n        },\n        \"threshold\": {\n          \"$ref\": \"#/definitions/envoy.config.overload.v3.ThresholdTrigger\",\n          \"additionalProperties\": false\n        },\n        \"scaled\": {\n          \"$ref\": \"#/definitions/envoy.config.overload.v3.ScaledTrigger\",\n          \"additionalProperties\": false\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Trigger\"\n    },\n    \"envoy.config.route.v3.HeaderMatcher\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Specifies the name of the header in the request.\"\n        },\n        \"exact_match\": {\n          \"type\": \"string\",\n          \"description\": \"If specified, header match will be performed based on the value of the header. .. attention::   This field is deprecated. Please use :ref:`string_match `.\"\n        },\n        \"safe_regex_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, this regex string is a regular expression rule which implies the entire request header value must match the regex. The rule will not match if only a subsequence of the request header value matches the regex. .. attention::   This field is deprecated. Please use :ref:`string_match `.\"\n        },\n        \"range_match\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Int64Range\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, header match will be performed based on range. The rule will match if the request header value is within this range. The entire request header value must represent an integer in base 10 notation: consisting of an optional plus or minus sign followed by a sequence of digits. The rule will not match if the header value does not represent an integer. Match will fail for empty values, floating point numbers or if only a subsequence of the header value is an integer. Examples: * For range [-10,0), route will match for header value -1, but not for 0, ``somestring``, 10.9,   ``-1somestring``\"\n        },\n        \"present_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"If specified as true, header match will be performed based on whether the header is in the request. If specified as false, header match will be performed based on whether the header is absent.\"\n        },\n        \"prefix_match\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"If specified, header match will be performed based on the prefix of the header value. .. note::   Empty prefix is not allowed. Please use ``present_match`` instead. .. attention::   This field is deprecated. Please use :ref:`string_match `. Examples: * The prefix ``abcd`` matches the value ``abcdxyz``, but not for ``abcxyz``.\"\n        },\n        \"suffix_match\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"If specified, header match will be performed based on the suffix of the header value. .. note::   Empty suffix is not allowed. Please use ``present_match`` instead. .. attention::   This field is deprecated. Please use :ref:`string_match `. Examples: * The suffix ``abcd`` matches the value ``xyzabcd``, but not for ``xyzbcd``.\"\n        },\n        \"contains_match\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"If specified, header match will be performed based on whether the header value contains the given value or not. .. note::   Empty contains match is not allowed. Please use ``present_match`` instead. .. attention::   This field is deprecated. Please use :ref:`string_match `. Examples: * The value ``abcd`` matches the value ``xyzabcdpqr``, but not for ``xyzbcdpqr``.\"\n        },\n        \"string_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, header match will be performed based on the string match of the header value.\"\n        },\n        \"invert_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"If specified, the match result will be inverted before checking. Defaults to ``false``. Examples: * The regex ``\\\\d{3}`` does not match the value ``1234``, so it will match when inverted. * The range [-10,0) will match the value -1, so it will not match when inverted.\"\n        },\n        \"treat_missing_header_as_empty\": {\n          \"type\": \"boolean\",\n          \"description\": \"If specified, for any header match rule, if the header match rule specified header does not exist, this header value will be treated as empty. Defaults to ``false``. Examples: * The header match rule specified header \\\"header1\\\" to range match of [0, 10],   :ref:`invert_match `   is set to true and :ref:`treat_missing_header_as_empty `   is set to true; The \\\"header1\\\" header is not present. The match rule will   treat the \\\"header1\\\" as an empty header. The empty header does not match the range,   so it will match when inverted. * The header match rule specified header \\\"header2\\\" to range match of [0, 10],   :ref:`invert_match `   is set to true and :ref:`treat_missing_header_as_empty `   is set to false; The \\\"header2\\\" header is not present and the header   matcher rule for \\\"header2\\\" will be ignored so it will not match. * The header match rule specified header \\\"header3\\\" to a string regex match   ``^$`` which means an empty string, and   :ref:`treat_missing_header_as_empty `   is set to true; The \\\"header3\\\" header is not present.   The match rule will treat the \\\"header3\\\" header as an empty header so it will match. * The header match rule specified header \\\"header4\\\" to a string regex match   ``^$`` which means an empty string, and   :ref:`treat_missing_header_as_empty `   is set to false; The \\\"header4\\\" header is not present.   The match rule for \\\"header4\\\" will be ignored so it will not match.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Matcher\",\n      \"description\": \".. attention::   Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1 ``Host``   header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. .. attention::   To route on HTTP method, use the special HTTP/2 ``:method`` header. This works for both   HTTP/1 and HTTP/2 as Envoy normalizes headers. E.g.,   .. code-block:: json     {       \\\"name\\\": \\\":method\\\",       \\\"string_match\\\": {         \\\"exact\\\": \\\"POST\\\"       }     } .. attention::   In the absence of any header match specifier, match will default to :ref:`present_match   `. i.e, a request that has the :ref:`name   ` header will match, regardless of the header's   value.  [#next-major-version: HeaderMatcher should be refactored to use StringMatcher.] [#next-free-field: 15]\"\n    },\n    \"envoy.config.trace.v3.Tracing\": {\n      \"properties\": {\n        \"http\": {\n          \"$ref\": \"#/definitions/envoy.config.trace.v3.Tracing.Http\",\n          \"additionalProperties\": false,\n          \"description\": \"Provides configuration for the HTTP tracer.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Tracing]\\n Tracing :ref:`architecture overview `.\",\n      \"description\": \"[#protodoc-title: Tracing] Tracing :ref:`architecture overview `.  The tracing configuration specifies settings for an HTTP tracer provider used by Envoy. Envoy may support other tracers in the future, but right now the HTTP tracer is the only one supported. .. attention::   Use of this message type has been deprecated in favor of direct use of   :ref:`Tracing.Http `.\"\n    },\n    \"envoy.config.trace.v3.Tracing.Http\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the HTTP trace driver to instantiate. The name must match a supported HTTP trace driver. See the :ref:`extensions listed in typed_config below ` for the default list of the HTTP trace driver.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http\",\n      \"description\": \"Configuration for an HTTP tracer provider used by Envoy. The configuration is defined by the :ref:`HttpConnectionManager.Tracing ` :ref:`provider ` field.\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance\": {\n      \"properties\": {\n        \"instance_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Provider instance name. Instance names should generally be defined not in terms of the underlying provider implementation (e.g., \\\"file_watcher\\\") but rather in terms of the function of the certificates (e.g., \\\"foo_deployment_identity\\\").\"\n        },\n        \"certificate_name\": {\n          \"type\": \"string\",\n          \"description\": \"Opaque name used to specify certificate instances or types. For example, \\\"ROOTCA\\\" to specify a root-certificate (validation context) or \\\"example.com\\\" to specify a certificate for a particular domain. Not all provider instances will actually use this field, so the value defaults to the empty string.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Certificate Provider Plugin Instance\",\n      \"description\": \"Indicates a certificate to be obtained from a named CertificateProvider plugin instance. The plugin instances are defined in the client's bootstrap file. The plugin allows certificates to be fetched/refreshed over the network asynchronously with respect to the TLS handshake. [#not-implemented-hide:]\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext\": {\n      \"properties\": {\n        \"trusted_ca\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate (e.g. server certificate for clusters or client certificate for listeners). If not specified and a peer certificate is presented it will not be verified. By default, a client certificate is optional, unless one of the additional options (:ref:`require_client_certificate `, :ref:`verify_certificate_spki `, :ref:`verify_certificate_hash `, or :ref:`match_typed_subject_alt_names `) is also specified. It can optionally contain certificate revocation lists, in which case Envoy will verify that the presented peer certificate has not been revoked by one of the included CRLs. Note that if a CRL is provided for any certificate authority in a trust chain, a CRL must be provided for all certificate authorities in that chain. Failure to do so will result in verification failure for both revoked and unrevoked certificates from that chain. The behavior of requiring all certificates to contain CRLs can be altered by setting :ref:`only_verify_leaf_cert_crl ` true. If set to true, only the final certificate in the chain undergoes CRL verification. See :ref:`the TLS overview ` for a list of common system CA locations. If ``trusted_ca`` is a filesystem path, a watch will be added to the parent directory for any file moves to support rotation. This currently only applies to dynamic secrets, when the ``CertificateValidationContext`` is delivered via SDS. X509_V_FLAG_PARTIAL_CHAIN is set by default, so non-root/intermediate ca certificate in ``trusted_ca`` can be treated as trust anchor as well. It allows verification with building valid partial chain instead of a full chain. If ``ca_certificate_provider_instance`` is set, it takes precedence over ``trusted_ca``.\"\n        },\n        \"ca_certificate_provider_instance\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.CertificateProviderPluginInstance\",\n          \"additionalProperties\": false,\n          \"description\": \"Certificate provider instance for fetching TLS certificates. If set, takes precedence over ``trusted_ca``. [#not-implemented-hide:]\"\n        },\n        \"system_root_certs\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCerts\",\n          \"additionalProperties\": false,\n          \"description\": \"Use system root certs for validation. If present, system root certs are used only if neither of the ``trusted_ca`` or ``ca_certificate_provider_instance`` fields are set. [#not-implemented-hide:]\"\n        },\n        \"watched_directory\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.WatchedDirectory\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, updates of a file-based ``trusted_ca`` source will be triggered by this watch. This allows explicit control over the path watched, by default the parent directory of the filesystem path in ``trusted_ca`` is watched if this field is not specified. This only applies when a ``CertificateValidationContext`` is delivered by SDS with references to filesystem paths. See the :ref:`SDS key rotation ` documentation for further details.\"\n        },\n        \"verify_certificate_spki\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate matches one of the specified values. A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate can be generated with the following command: .. code-block:: bash   $ openssl x509 -in path/to/client.crt -noout -pubkey     | openssl pkey -pubin -outform DER     | openssl dgst -sha256 -binary     | openssl enc -base64   NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A= This is the format used in HTTP Public Key Pinning. When both: :ref:`verify_certificate_hash ` and :ref:`verify_certificate_spki ` are specified, a hash matching value from either of the lists will result in the certificate being accepted. .. attention::   This option is preferred over :ref:`verify_certificate_hash   `,   because SPKI is tied to a private key, so it doesn't change when the certificate   is renewed using the same private key.\"\n        },\n        \"verify_certificate_hash\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that the SHA-256 of the DER-encoded presented certificate matches one of the specified values. A hex-encoded SHA-256 of the certificate can be generated with the following command: .. code-block:: bash   $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d\\\" \\\" -f2   df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a A long hex-encoded and colon-separated SHA-256 (a.k.a. \\\"fingerprint\\\") of the certificate can be generated with the following command: .. code-block:: bash   $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d\\\"=\\\" -f2   DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A Both of those formats are acceptable. When both: :ref:`verify_certificate_hash ` and :ref:`verify_certificate_spki ` are specified, a hash matching value from either of the lists will result in the certificate being accepted.\"\n        },\n        \"match_typed_subject_alt_names\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"An optional list of Subject Alternative name matchers. If specified, Envoy will verify that the Subject Alternative Name of the presented certificate matches one of the specified matchers. The matching uses \\\"any\\\" semantics, that is to say, the SAN is verified if at least one matcher is matched. When a certificate has wildcard DNS SAN entries, to match a specific client, it should be configured with exact match type in the :ref:`string matcher `. For example if the certificate has \\\"\\\\*.example.com\\\" as DNS SAN entry, to allow only \\\"api.example.com\\\", it should be configured as shown below. .. code-block:: yaml  match_typed_subject_alt_names:  - san_type: DNS    matcher:      exact: \\\"api.example.com\\\" .. attention::   Subject Alternative Names are easily spoofable and verifying only them is insecure,   therefore this option must be used together with :ref:`trusted_ca   `.\"\n        },\n        \"match_subject_alt_names\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"This field is deprecated in favor of :ref:`match_typed_subject_alt_names `. Note that if both this field and :ref:`match_typed_subject_alt_names ` are specified, the former (deprecated field) is ignored.\"\n        },\n        \"require_signed_certificate_timestamp\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Must present signed certificate time-stamp.\"\n        },\n        \"crl\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"An optional `certificate revocation list `_ (in PEM format). If specified, Envoy will verify that the presented peer certificate has not been revoked by this CRL. If this DataSource contains multiple CRLs, all of them will be used. Note that if a CRL is provided for any certificate authority in a trust chain, a CRL must be provided for all certificate authorities in that chain. Failure to do so will result in verification failure for both revoked and unrevoked certificates from that chain. This default behavior can be altered by setting :ref:`only_verify_leaf_cert_crl ` to true. If ``crl`` is a filesystem path, a watch will be added to the parent directory for any file moves to support rotation. This currently only applies to dynamic secrets, when the ``CertificateValidationContext`` is delivered via SDS.\"\n        },\n        \"allow_expired_certificate\": {\n          \"type\": \"boolean\",\n          \"description\": \"If specified, Envoy will not reject expired certificates.\"\n        },\n        \"trust_chain_verification\": {\n          \"enum\": [\n            \"VERIFY_TRUST_CHAIN\",\n            0,\n            \"ACCEPT_UNTRUSTED\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Trust Chain Verification\",\n          \"description\": \"Peer certificate verification mode.\"\n        },\n        \"custom_validator_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"The configuration of an extension specific certificate validator. If specified, all validation is done by the specified validator, and the behavior of all other validation settings is defined by the specified validator (and may be entirely ignored, unused, and unvalidated). Refer to the documentation for the specified validator. If you do not want a custom validation algorithm, do not set this field. [#extension-category: envoy.tls.cert_validator]\"\n        },\n        \"only_verify_leaf_cert_crl\": {\n          \"type\": \"boolean\",\n          \"description\": \"If this option is set to true, only the certificate at the end of the certificate chain will be subject to validation by :ref:`CRL `.\"\n        },\n        \"max_verify_depth\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Defines maximum depth of a certificate chain accepted in verification, the default limit is 100, though this can be system-dependent. This number does not include the leaf but includes the trust anchor, so a depth of 1 allows the leaf and one CA certificate. If a trusted issuer appears in the chain, but in a depth larger than configured, the certificate validation will fail. This matches the semantics of ``SSL_CTX_set_verify_depth`` in OpenSSL 1.0.x and older versions of BoringSSL. It differs from ``SSL_CTX_set_verify_depth`` in OpenSSL 1.1.x and newer versions of BoringSSL in that the trust anchor is included. Trusted issues are specified by setting :ref:`trusted_ca `\"\n        },\n        \"suppress_client_ca_list\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the server does not include the trusted-CA distinguished names in the TLS ``CertificateRequest`` message. CAs from :ref:`trusted_ca ` are still used to validate presented client certificates; only the wire advertisement changes. This is useful when the configured CA set is large enough that the ``CertificateRequest`` would exceed client-side TLS record limits, or when clients mishandle the CA set in some way. .. attention::   When enabled, clients that rely on the advertised CA list to select among   multiple client certificates may now send no certificate or the wrong one;   validation will then fail with the standard TLS alert. This option only affects downstream (server) TLS connections where Envoy sends a ``CertificateRequest`` to clients. It has no effect on upstream connections. Honored by the built-in validator and the SPIFFE validator. Validators that do not set a client CA list themselves (e.g., the dynamic-modules validator) are unaffected. Defaults to false.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Certificate Validation Context\",\n      \"description\": \"[#next-free-field: 19]\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext.SystemRootCerts\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"System Root Certs\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.GenericSecret\": {\n      \"properties\": {\n        \"secret\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Secret of generic type and is available to filters. It is expected that only only one of secret and secrets is set.\"\n        },\n        \"secrets\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"For cases where multiple associated secrets need to be distributed together. It is expected that only only one of secret and secrets is set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Secrets configuration]\",\n      \"description\": \"[#protodoc-title: Secrets configuration]\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider\": {\n      \"properties\": {\n        \"provider_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Private key method provider name. The name must match a supported private key method provider type.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"fallback\": {\n          \"type\": \"boolean\",\n          \"description\": \"If the private key provider isn't available (eg. the required hardware capability doesn't existed), Envoy will fallback to the BoringSSL default implementation when the ``fallback`` is true. The default value is ``false``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Private Key Provider\",\n      \"description\": \"BoringSSL private key method configuration. The private key methods are used for external (potentially asynchronous) signing and decryption operations. Some use cases for private key methods would be TPM support and TLS acceleration.\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.Secret\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"Name (FQDN, UUID, SPKI, SHA256, etc.) by which the secret can be uniquely referred to.\"\n        },\n        \"tls_certificate\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.TlsCertificate\",\n          \"additionalProperties\": false\n        },\n        \"session_ticket_keys\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys\",\n          \"additionalProperties\": false\n        },\n        \"validation_context\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext\",\n          \"additionalProperties\": false\n        },\n        \"generic_secret\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.GenericSecret\",\n          \"additionalProperties\": false\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Secret\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.SubjectAltNameMatcher\": {\n      \"properties\": {\n        \"san_type\": {\n          \"enum\": [\n            \"SAN_TYPE_UNSPECIFIED\",\n            0,\n            \"EMAIL\",\n            1,\n            \"DNS\",\n            2,\n            \"URI\",\n            3,\n            \"IP_ADDRESS\",\n            4,\n            \"OTHER_NAME\",\n            5\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"San Type\",\n          \"description\": \"Indicates the choice of GeneralName as defined in section 4.2.1.5 of RFC 5280 to match against.\"\n        },\n        \"matcher\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Matcher for SAN value. If the :ref:`san_type ` is :ref:`DNS ` and the matcher type is :ref:`exact `, DNS wildcards are evaluated according to the rules in https://www.rfc-editor.org/rfc/rfc6125#section-6.4.3. For example, ``*.example.com`` would match ``test.example.com`` but not ``example.com`` and not ``a.b.example.com``. The string matching for OTHER_NAME SAN values depends on their ASN.1 type:          * OBJECT: Validated against its dotted numeric notation (e.g., \\\"1.2.3.4\\\")          * BOOLEAN: Validated against strings \\\"true\\\" or \\\"false\\\"          * INTEGER/ENUMERATED: Validated against a string containing the integer value          * NULL: Validated against an empty string          * Other types: Validated directly against the string value\"\n        },\n        \"oid\": {\n          \"type\": \"string\",\n          \"description\": \"OID Value which is required if OTHER_NAME SAN type is used. For example, UPN OID is 1.3.6.1.4.1.311.20.2.3 (Reference: http://oid-info.com/get/1.3.6.1.4.1.311.20.2.3). If set for SAN types other than OTHER_NAME, it will be ignored.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Subject Alt Name Matcher\",\n      \"description\": \"Matcher for subject alternative names, to match both type and value of the SAN.\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.TlsCertificate\": {\n      \"properties\": {\n        \"certificate_chain\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"The TLS certificate chain. If ``certificate_chain`` is a filesystem path, a watch will be added to the parent directory for any file moves to support rotation. This currently only applies to dynamic secrets, when the ``TlsCertificate`` is delivered via SDS.\"\n        },\n        \"private_key\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"The TLS private key. If ``private_key`` is a filesystem path, a watch will be added to the parent directory for any file moves to support rotation. This currently only applies to dynamic secrets, when the ``TlsCertificate`` is delivered via SDS.\"\n        },\n        \"pkcs12\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"``Pkcs12`` data containing TLS certificate, chain, and private key. If ``pkcs12`` is a filesystem path, the file will be read, but no watch will be added to the parent directory, since ``pkcs12`` isn't used by SDS. This field is mutually exclusive with ``certificate_chain``, ``private_key`` and ``private_key_provider``. This can't be marked as ``oneof`` due to API compatibility reasons. Setting both :ref:`private_key `, :ref:`certificate_chain `, or :ref:`private_key_provider ` and :ref:`pkcs12 ` fields will result in an error. Use :ref:`password ` to specify the password to unprotect the ``PKCS12`` data, if necessary.\"\n        },\n        \"watched_directory\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.WatchedDirectory\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, updates of file-based ``certificate_chain`` and ``private_key`` sources will be triggered by this watch. The certificate/key pair will be read together and validated for atomic read consistency (i.e. no intervening modification occurred between cert/key read, verified by file hash comparisons). This allows explicit control over the path watched, by default the parent directories of the filesystem paths in ``certificate_chain`` and ``private_key`` are watched if this field is not specified. This only applies when a ``TlsCertificate`` is delivered by SDS with references to filesystem paths. See the :ref:`SDS key rotation ` documentation for further details.\"\n        },\n        \"private_key_provider\": {\n          \"$ref\": \"#/definitions/envoy.extensions.transport_sockets.tls.v3.PrivateKeyProvider\",\n          \"additionalProperties\": false,\n          \"description\": \"BoringSSL private key method provider. This is an alternative to :ref:`private_key ` field. When both :ref:`private_key ` and :ref:`private_key_provider ` fields are set, ``private_key_provider`` takes precedence. If ``private_key_provider`` is unavailable and :ref:`fallback ` is enabled, ``private_key`` will be used.\"\n        },\n        \"password\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"The password to decrypt the TLS private key. If this field is not set, it is assumed that the TLS private key is not password encrypted.\"\n        },\n        \"ocsp_staple\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"The OCSP response to be stapled with this certificate during the handshake. The response must be DER-encoded and may only be  provided via ``filename`` or ``inline_bytes``. The response may pertain to only one certificate.\"\n        },\n        \"signed_certificate_timestamp\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"[#not-implemented-hide:]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tls Certificate\",\n      \"description\": \"[#next-free-field: 9]\"\n    },\n    \"envoy.extensions.transport_sockets.tls.v3.TlsSessionTicketKeys\": {\n      \"properties\": {\n        \"keys\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Keys for encrypting and decrypting TLS session tickets. The first key in the array contains the key to encrypt all new sessions created by this context. All keys are candidates for decrypting received tickets. This allows for easy rotation of keys by, for example, putting the new key first, and the previous key second. If :ref:`session_ticket_keys ` is not specified, the TLS library will still support resuming sessions via tickets, but it will use an internally-generated and managed key, so sessions cannot be resumed across hot restarts or on different hosts. Each key must contain exactly 80 bytes of cryptographically-secure random data. For example, the output of ``openssl rand 80``. .. attention::   Using this feature has serious security considerations and risks. Improper handling of keys   may result in loss of secrecy in connections, even if ciphers supporting perfect forward   secrecy are used. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for some   discussion. To minimize the risk, you must:   * Keep the session ticket keys at least as secure as your TLS certificate private keys   * Rotate session ticket keys at least daily, and preferably hourly   * Always generate keys using a cryptographically-secure random data source\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tls Session Ticket Keys\"\n    },\n    \"envoy.type.matcher.v3.DoubleMatcher\": {\n      \"properties\": {\n        \"range\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.DoubleRange\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, the input double value must be in the range specified here. Note: The range is using half-open interval semantics [start, end).\"\n        },\n        \"exact\": {\n          \"type\": \"number\",\n          \"description\": \"If specified, the input double value must be equal to the value specified here.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Number matcher]\",\n      \"description\": \"[#protodoc-title: Number matcher]  Specifies the way to match a double value.\"\n    },\n    \"envoy.type.matcher.v3.ListMatcher\": {\n      \"properties\": {\n        \"one_of\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.ValueMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, at least one of the values in the list must match the value specified.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"List Matcher\",\n      \"description\": \"Specifies the way to match a list value.\"\n    },\n    \"envoy.type.matcher.v3.ListStringMatcher\": {\n      \"properties\": {\n        \"patterns\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"List String Matcher\",\n      \"description\": \"Specifies a list of ways to match a string.\"\n    },\n    \"envoy.type.matcher.v3.MetadataMatcher\": {\n      \"properties\": {\n        \"filter\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The filter name to retrieve the ``Struct`` from the ``Metadata``.\"\n        },\n        \"path\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.MetadataMatcher.PathSegment\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The path to retrieve the ``Value`` from the ``Struct``.\"\n        },\n        \"value\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.ValueMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The ``MetadataMatcher`` is matched if the value retrieved by path is matched to this value.\"\n        },\n        \"invert\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the match result will be inverted.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"``MetadataMatcher`` provides a general interface to check if a given value is matched in\\n :ref:`Metadata `. It uses ``filter`` and ``path`` to retrieve the value\\n from the ``Metadata`` and then check if it's matched to the specified value.\\n\\n For example, for the following ``Metadata``:\\n\\n .. code-block:: yaml\\n\\n    filter_metadata:\\n      envoy.filters.http.rbac:\\n        fields:\\n          a:\\n            struct_value:\\n              fields:\\n                b:\\n                  struct_value:\\n                    fields:\\n                      c:\\n                        string_value: pro\\n                t:\\n                  list_value:\\n                    values:\\n                      - string_value: m\\n                      - string_value: n\\n\\n The following ``MetadataMatcher`` is matched as the path ``[a, b, c]`` will retrieve a string value ``pro``\\n from the ``Metadata`` which is matched to the specified prefix match.\\n\\n .. code-block:: yaml\\n\\n    filter: envoy.filters.http.rbac\\n    path:\\n    - key: a\\n    - key: b\\n    - key: c\\n    value:\\n      string_match:\\n        prefix: pr\\n\\n The following ``MetadataMatcher`` is matched as the code will match one of the string values in the\\n list at the path [a, t].\\n\\n .. code-block:: yaml\\n\\n    filter: envoy.filters.http.rbac\\n    path:\\n    - key: a\\n    - key: t\\n    value:\\n      list_match:\\n        one_of:\\n          string_match:\\n            exact: m\\n\\n An example use of ``MetadataMatcher`` is specifying additional metadata in ``envoy.filters.http.rbac`` to\\n enforce access control based on dynamic metadata in a request. See :ref:`Permission\\n ` and :ref:`Principal\\n `.\",\n      \"description\": \"[#protodoc-title: Metadata matcher]  ``MetadataMatcher`` provides a general interface to check if a given value is matched in :ref:`Metadata `. It uses ``filter`` and ``path`` to retrieve the value from the ``Metadata`` and then check if it's matched to the specified value. For example, for the following ``Metadata``: .. code-block:: yaml    filter_metadata:      envoy.filters.http.rbac:        fields:          a:            struct_value:              fields:                b:                  struct_value:                    fields:                      c:                        string_value: pro                t:                  list_value:                    values:                      - string_value: m                      - string_value: n The following ``MetadataMatcher`` is matched as the path ``[a, b, c]`` will retrieve a string value ``pro`` from the ``Metadata`` which is matched to the specified prefix match. .. code-block:: yaml    filter: envoy.filters.http.rbac    path:    - key: a    - key: b    - key: c    value:      string_match:        prefix: pr The following ``MetadataMatcher`` is matched as the code will match one of the string values in the list at the path [a, t]. .. code-block:: yaml    filter: envoy.filters.http.rbac    path:    - key: a    - key: t    value:      list_match:        one_of:          string_match:            exact: m An example use of ``MetadataMatcher`` is specifying additional metadata in ``envoy.filters.http.rbac`` to enforce access control based on dynamic metadata in a request. See :ref:`Permission ` and :ref:`Principal `.  [#next-major-version: MetadataMatcher should use StructMatcher]\"\n    },\n    \"envoy.type.matcher.v3.MetadataMatcher.PathSegment\": {\n      \"properties\": {\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"If specified, use the key to retrieve the value in a ``Struct``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Path Segment\",\n      \"description\": \"Specifies the segment in a path to retrieve value from ``Metadata``. .. note::   Currently it's not supported to retrieve a value from a list in ``Metadata``. This means that   if the segment key refers to a list, it has to be the last segment in a path.\"\n    },\n    \"envoy.type.matcher.v3.OrMatcher\": {\n      \"properties\": {\n        \"value_matchers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.ValueMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Or Matcher\",\n      \"description\": \"Specifies a list of alternatives for the match.\"\n    },\n    \"envoy.type.matcher.v3.RegexMatcher\": {\n      \"properties\": {\n        \"google_re2\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatcher.GoogleRE2\",\n          \"additionalProperties\": false,\n          \"description\": \"Google's RE2 regex engine.\"\n        },\n        \"regex\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The regex match string. The string must be supported by the configured engine. The regex is matched against the full string, not as a partial match.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Regex matcher]\",\n      \"description\": \"[#protodoc-title: Regex matcher]  A regex matcher designed for safety when used with untrusted input.\"\n    },\n    \"envoy.type.matcher.v3.RegexMatcher.GoogleRE2\": {\n      \"properties\": {\n        \"max_program_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"This field controls the RE2 \\\"program size\\\" which is a rough estimate of how complex a compiled regex is to evaluate. A regex that has a program size greater than the configured value will fail to compile. In this case, the configured max program size can be increased or the regex can be simplified. If not specified, the default is 100. This field is deprecated; regexp validation should be performed on the management server instead of being done by each individual client. .. note::  Although this field is deprecated, the program size will still be checked against the  global ``re2.max_program_size.error_level`` runtime value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Google RE 2\",\n      \"description\": \"Google's `RE2 `_ regex engine. The regex string must adhere to the documented `syntax `_. The engine is designed to complete execution in linear time as well as limit the amount of memory used. Envoy supports program size checking via runtime. The runtime keys ``re2.max_program_size.error_level`` and ``re2.max_program_size.warn_level`` can be set to integers as the maximum program size or complexity that a compiled regex can have before an exception is thrown or a warning is logged, respectively. ``re2.max_program_size.error_level`` defaults to 100, and ``re2.max_program_size.warn_level`` has no default if unset (will not check/log a warning). Envoy emits two stats for tracking the program size of regexes: the histogram ``re2.program_size``, which records the program size, and the counter ``re2.exceeded_warn_level``, which is incremented each time the program size exceeds the warn level threshold.\"\n    },\n    \"envoy.type.matcher.v3.StringMatcher\": {\n      \"properties\": {\n        \"exact\": {\n          \"type\": \"string\",\n          \"description\": \"The input string must match exactly the string specified here. Examples: * ``abc`` only matches the value ``abc``.\"\n        },\n        \"prefix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The input string must have the prefix specified here. .. note::  Empty prefix match is not allowed, please use ``safe_regex`` instead. Examples: * ``abc`` matches the value ``abc.xyz``\"\n        },\n        \"suffix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The input string must have the suffix specified here. .. note::  Empty suffix match is not allowed, please use ``safe_regex`` instead. Examples: * ``abc`` matches the value ``xyz.abc``\"\n        },\n        \"safe_regex\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The input string must match the regular expression specified here.\"\n        },\n        \"contains\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The input string must have the substring specified here. .. note::  Empty contains match is not allowed, please use ``safe_regex`` instead. Examples: * ``abc`` matches the value ``xyz.abc.def``\"\n        },\n        \"custom\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Use an extension as the matcher type. [#extension-category: envoy.string_matcher]\"\n        },\n        \"ignore_case\": {\n          \"type\": \"boolean\",\n          \"description\": \"If ``true``, indicates the exact/prefix/suffix/contains matching should be case insensitive. This has no effect for the ``safe_regex`` match. For example, the matcher ``data`` will match both input string ``Data`` and ``data`` if this option is set to ``true``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: String matcher]\",\n      \"description\": \"[#protodoc-title: String matcher]  Specifies the way to match a string. [#next-free-field: 9]\"\n    },\n    \"envoy.type.matcher.v3.ValueMatcher\": {\n      \"properties\": {\n        \"null_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.ValueMatcher.NullMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, a match occurs if and only if the target value is a NullValue.\"\n        },\n        \"double_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.DoubleMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, a match occurs if and only if the target value is a double value and is matched to this field.\"\n        },\n        \"string_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, a match occurs if and only if the target value is a string value and is matched to this field.\"\n        },\n        \"bool_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"If specified, a match occurs if and only if the target value is a bool value and is equal to this field.\"\n        },\n        \"present_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"If specified, value match will be performed based on whether the path is referring to a valid primitive value in the metadata. If the path is referring to a non-primitive value, the result is always not matched.\"\n        },\n        \"list_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.ListMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, a match occurs if and only if the target value is a list value and is matched to this field.\"\n        },\n        \"or_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.OrMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, a match occurs if and only if any of the alternatives in the match accept the value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Value matcher]\",\n      \"description\": \"[#protodoc-title: Value matcher]  Specifies the way to match a Protobuf::Value. Primitive values and ListValue are supported. StructValue is not supported and is always not matched. [#next-free-field: 8]\"\n    },\n    \"envoy.type.matcher.v3.ValueMatcher.NullMatch\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Null Match\",\n      \"description\": \"NullMatch is an empty message to specify a null value.\"\n    },\n    \"envoy.type.metadata.v3.MetadataKey\": {\n      \"properties\": {\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The key name of the Metadata from which to retrieve the Struct. This typically represents a builtin subsystem or custom extension.\"\n        },\n        \"path\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKey.PathSegment\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The path used to retrieve a specific Value from the Struct. This can be either a prefix or a full path, depending on the use case. For example, ``[prop, xyz]`` would retrieve a struct or ``[prop, foo]`` would retrieve a string in the example above. .. note::   Since only key-type segments are supported, a path cannot specify a list   unless the list is the last segment.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Metadata]\",\n      \"description\": \"[#protodoc-title: Metadata]  MetadataKey provides a way to retrieve values from :ref:`Metadata ` using a ``key`` and a ``path``. For example, consider the following Metadata: .. code-block:: yaml    filter_metadata:      envoy.xxx:        prop:          foo: bar          xyz:            hello: envoy The following MetadataKey would retrieve the string value \\\"bar\\\" from the Metadata: .. code-block:: yaml    key: envoy.xxx    path:    - key: prop    - key: foo\"\n    },\n    \"envoy.type.metadata.v3.MetadataKey.PathSegment\": {\n      \"properties\": {\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"If specified, use this key to retrieve the value in a Struct.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Path Segment\",\n      \"description\": \"Specifies a segment in a path for retrieving values from Metadata. Currently, only key-based segments (field names) are supported.\"\n    },\n    \"envoy.type.v3.DoubleRange\": {\n      \"properties\": {\n        \"start\": {\n          \"type\": \"number\",\n          \"description\": \"start of the range (inclusive)\"\n        },\n        \"end\": {\n          \"type\": \"number\",\n          \"description\": \"end of the range (exclusive)\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Double Range\",\n      \"description\": \"Specifies the double start and end of the range using half-open interval semantics [start, end).\"\n    },\n    \"envoy.type.v3.FractionalPercent\": {\n      \"properties\": {\n        \"numerator\": {\n          \"type\": \"integer\",\n          \"description\": \"Specifies the numerator. Defaults to 0.\"\n        },\n        \"denominator\": {\n          \"enum\": [\n            \"HUNDRED\",\n            0,\n            \"TEN_THOUSAND\",\n            1,\n            \"MILLION\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Denominator Type\",\n          \"description\": \"Fraction percentages support several fixed denominator values.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Fractional Percent\",\n      \"description\": \"A fractional percentage is used in cases in which for performance reasons performing floating point to integer conversions during randomness calculations is undesirable. The message includes both a numerator and denominator that together determine the final fractional value. * **Example**: 1/100 = 1%. * **Example**: 3/10000 = 0.03%.\"\n    },\n    \"envoy.type.v3.Int32Range\": {\n      \"properties\": {\n        \"start\": {\n          \"type\": \"integer\",\n          \"description\": \"start of the range (inclusive)\"\n        },\n        \"end\": {\n          \"type\": \"integer\",\n          \"description\": \"end of the range (exclusive)\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Int 32 Range\",\n      \"description\": \"Specifies the int32 start and end of the range using half-open interval semantics [start, end).\"\n    },\n    \"envoy.type.v3.Int64Range\": {\n      \"properties\": {\n        \"start\": {\n          \"type\": \"string\",\n          \"description\": \"start of the range (inclusive)\"\n        },\n        \"end\": {\n          \"type\": \"string\",\n          \"description\": \"end of the range (exclusive)\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Range]\",\n      \"description\": \"[#protodoc-title: Range]  Specifies the int64 start and end of the range using half-open interval semantics [start, end).\"\n    },\n    \"envoy.type.v3.Percent\": {\n      \"properties\": {\n        \"value\": {\n          \"type\": \"number\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Percent]\",\n      \"description\": \"[#protodoc-title: Percent]  Identifies a percentage, in the range [0.0, 100.0].\"\n    },\n    \"envoy.type.v3.SemanticVersion\": {\n      \"properties\": {\n        \"major_number\": {\n          \"type\": \"integer\"\n        },\n        \"minor_number\": {\n          \"type\": \"integer\"\n        },\n        \"patch\": {\n          \"type\": \"integer\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Semantic version]\",\n      \"description\": \"[#protodoc-title: Semantic version]  Envoy uses SemVer (https://semver.org/). Major/minor versions indicate expected behaviors and APIs, the patch version field is used only for security fixes and can be generally ignored.\"\n    },\n    \"xds.core.v3.Authority\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Authority\",\n      \"description\": \"xDS authority information.\"\n    },\n    \"xds.core.v3.ContextParams\": {\n      \"properties\": {\n        \"params\": {\n          \"additionalProperties\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"object\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Context Params\",\n      \"description\": \"Additional parameters that can be used to select resource variants. These include any global context parameters, per-resource type client feature capabilities and per-resource type functional attributes. All per-resource type attributes will be `xds.resource.` prefixed and some of these are documented below: `xds.resource.listening_address`: The value is \\\"IP:port\\\" (e.g. \\\"10.1.1.3:8080\\\") which is   the listening address of a Listener. Used in a Listener resource query.\"\n    },\n    \"xds.core.v3.TypedExtensionConfig\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of an extension. This is not used to select the extension, instead it serves the role of an opaque identifier.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Typed Extension Config\",\n      \"description\": \"Message type for extension configuration.\"\n    },\n    \"xds.type.matcher.v3.Matcher\": {\n      \"properties\": {\n        \"matcher_list\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList\",\n          \"additionalProperties\": false,\n          \"description\": \"A linear list of matchers to evaluate.\"\n        },\n        \"matcher_tree\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherTree\",\n          \"additionalProperties\": false,\n          \"description\": \"A match tree to evaluate.\"\n        },\n        \"on_no_match\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.OnMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional OnMatch to use if no matcher above matched (e.g., if there are no matchers specified above, or if none of the matches specified above succeeded). If no matcher above matched and this field is not populated, the match will be considered unsuccessful.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Unified Matcher API]\",\n      \"description\": \"[#protodoc-title: Unified Matcher API]  A matcher, which may traverse a matching tree in order to result in a match action. During matching, the tree will be traversed until a match is found, or if no match is found the action specified by the most specific on_no_match will be evaluated. As an on_no_match might result in another matching tree being evaluated, this process might repeat several times until the final OnMatch (or no match) is decided.\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherList\": {\n      \"properties\": {\n        \"matchers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.FieldMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of matchers. First match wins.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Matcher List\",\n      \"description\": \"A linear list of field matchers. The field matchers are evaluated in order, and the first match wins.\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherList.FieldMatcher\": {\n      \"properties\": {\n        \"predicate\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.Predicate\",\n          \"additionalProperties\": false,\n          \"description\": \"Determines if the match succeeds.\"\n        },\n        \"on_match\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.OnMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"What to do if the match succeeds.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Field Matcher\",\n      \"description\": \"An individual matcher.\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherList.Predicate\": {\n      \"properties\": {\n        \"single_predicate\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.Predicate.SinglePredicate\",\n          \"additionalProperties\": false,\n          \"description\": \"A single predicate to evaluate.\"\n        },\n        \"or_matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.Predicate.PredicateList\",\n          \"additionalProperties\": false,\n          \"description\": \"A list of predicates to be OR-ed together.\"\n        },\n        \"and_matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.Predicate.PredicateList\",\n          \"additionalProperties\": false,\n          \"description\": \"A list of predicates to be AND-ed together.\"\n        },\n        \"not_matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.Predicate\",\n          \"additionalProperties\": false,\n          \"description\": \"The invert of a predicate\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Predicate\",\n      \"description\": \"Predicate to determine if a match is successful.\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherList.Predicate.PredicateList\": {\n      \"properties\": {\n        \"predicate\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherList.Predicate\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Predicate List\",\n      \"description\": \"A list of two or more matchers. Used to allow using a list within a oneof.\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherList.Predicate.SinglePredicate\": {\n      \"properties\": {\n        \"input\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Protocol-specific specification of input field to match on. [#extension-category: envoy.matching.common_inputs]\"\n        },\n        \"value_match\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Built-in string matcher.\"\n        },\n        \"custom_match\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Extension for custom matching logic. [#extension-category: envoy.matching.input_matchers]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Single Predicate\",\n      \"description\": \"Predicate for a single input field.\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherTree\": {\n      \"properties\": {\n        \"input\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Protocol-specific specification of input field to match on.\"\n        },\n        \"exact_match_map\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherTree.MatchMap\",\n          \"additionalProperties\": false\n        },\n        \"prefix_match_map\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.MatcherTree.MatchMap\",\n          \"additionalProperties\": false,\n          \"description\": \"Longest matching prefix wins.\"\n        },\n        \"custom_match\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Extension for custom matching logic.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Matcher Tree\"\n    },\n    \"xds.type.matcher.v3.Matcher.MatcherTree.MatchMap\": {\n      \"properties\": {\n        \"map\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher.OnMatch\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Match Map\",\n      \"description\": \"A map of configured matchers. Used to allow using a map within a oneof.\"\n    },\n    \"xds.type.matcher.v3.Matcher.OnMatch\": {\n      \"properties\": {\n        \"matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Nested matcher to evaluate. If the nested matcher does not match and does not specify on_no_match, then this matcher is considered not to have matched, even if a predicate at this level or above returned true.\"\n        },\n        \"action\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Protocol-specific action to take.\"\n        },\n        \"keep_matching\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true and the Matcher matches, the action will be taken but the caller will behave as if the Matcher did not match. A subsequent matcher or on_no_match action will be used instead. This field is not supported in all contexts in which the matcher API is used. If this field is set in a context in which it's not supported, the resource will be rejected.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"On Match\",\n      \"description\": \"What to do if a match is successful.\"\n    },\n    \"xds.type.matcher.v3.RegexMatcher\": {\n      \"properties\": {\n        \"google_re2\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.RegexMatcher.GoogleRE2\",\n          \"additionalProperties\": false,\n          \"description\": \"Google's RE2 regex engine.\"\n        },\n        \"regex\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The regex match string. The string must be supported by the configured engine.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Regex matcher]\",\n      \"description\": \"[#protodoc-title: Regex matcher]  A regex matcher designed for safety when used with untrusted input.\"\n    },\n    \"xds.type.matcher.v3.RegexMatcher.GoogleRE2\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Google RE 2\",\n      \"description\": \"Google's `RE2 `_ regex engine. The regex string must adhere to the documented `syntax `_. The engine is designed to complete execution in linear time as well as limit the amount of memory used. Envoy supports program size checking via runtime. The runtime keys `re2.max_program_size.error_level` and `re2.max_program_size.warn_level` can be set to integers as the maximum program size or complexity that a compiled regex can have before an exception is thrown or a warning is logged, respectively. `re2.max_program_size.error_level` defaults to 100, and `re2.max_program_size.warn_level` has no default if unset (will not check/log a warning). Envoy emits two stats for tracking the program size of regexes: the histogram `re2.program_size`, which records the program size, and the counter `re2.exceeded_warn_level`, which is incremented each time the program size exceeds the warn level threshold.\"\n    },\n    \"xds.type.matcher.v3.StringMatcher\": {\n      \"properties\": {\n        \"exact\": {\n          \"type\": \"string\",\n          \"description\": \"The input string must match exactly the string specified here. Examples: * *abc* only matches the value *abc*.\"\n        },\n        \"prefix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The input string must have the prefix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * *abc* matches the value *abc.xyz*\"\n        },\n        \"suffix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The input string must have the suffix specified here. Note: empty prefix is not allowed, please use regex instead. Examples: * *abc* matches the value *xyz.abc*\"\n        },\n        \"safe_regex\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.RegexMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The input string must match the regular expression specified here.\"\n        },\n        \"contains\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The input string must have the substring specified here. Note: empty contains match is not allowed, please use regex instead. Examples: * *abc* matches the value *xyz.abc.def*\"\n        },\n        \"custom\": {\n          \"$ref\": \"#/definitions/xds.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Use an extension as the matcher type. [#extension-category: envoy.string_matcher]\"\n        },\n        \"ignore_case\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, indicates the exact/prefix/suffix matching should be case insensitive. This has no effect for the safe_regex match. For example, the matcher *data* will match both input string *Data* and *data* if set to true.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: String matcher]\",\n      \"description\": \"[#protodoc-title: String matcher]  Specifies the way to match a string. [#next-free-field: 9]\"\n    },\n    \"Cors\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Cors]\\n CORS Filter :ref:`configuration overview `.\\n [#extension: envoy.filters.http.cors]\",\n      \"description\": \"[#protodoc-title: Cors] CORS Filter :ref:`configuration overview `. [#extension: envoy.filters.http.cors]  Cors filter config. Set this in :ref:`http_filters ` to enable the CORS filter. Please note that the :ref:`CorsPolicy ` must be configured in the ``RouteConfiguration`` as ``typed_per_filter_config`` at some level to make the filter work.\",\n      \"properties\": {\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      }\n    },\n    \"GrpcJsonTranscoder\": {\n      \"properties\": {\n        \"proto_descriptor\": {\n          \"type\": \"string\",\n          \"description\": \"Supplies the filename of :ref:`the proto descriptor set ` for the gRPC services.\"\n        },\n        \"proto_descriptor_bin\": {\n          \"type\": \"string\",\n          \"description\": \"Supplies the binary content of :ref:`the proto descriptor set ` for the gRPC services.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        },\n        \"services\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"A list of strings that supplies the fully qualified service names (i.e. \\\"package_name.service_name\\\") that the transcoder will translate. If the service name doesn't exist in ``proto_descriptor``, Envoy will fail at startup. The ``proto_descriptor`` may contain more services than the service names specified here, but they won't be translated. By default, the filter will pass through requests that do not map to any specified services. If the list of services is empty, filter is considered disabled. However, this behavior changes if :ref:`reject_unknown_method ` is enabled.\"\n        },\n        \"print_options\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder.PrintOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Control options for response JSON. These options are passed directly to `JsonPrintOptions `_.\"\n        },\n        \"match_incoming_request_route\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to keep the incoming request route after the outgoing headers have been transformed to the match the upstream gRPC service. Note: This means that routes for gRPC services that are not transcoded cannot be used in combination with ``match_incoming_request_route``.\"\n        },\n        \"ignored_query_parameters\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"A list of query parameters to be ignored for transcoding method mapping. By default, the transcoder filter will not transcode a request if there are any unknown/invalid query parameters. Example : .. code-block:: proto     service Bookstore {       rpc GetShelf(GetShelfRequest) returns (Shelf) {         option (google.api.http) = {           get: \\\"/shelves/{shelf}\\\"         };       }     }     message GetShelfRequest {       int64 shelf = 1;     }     message Shelf {} The request ``/shelves/100?foo=bar`` will not be mapped to ``GetShelf``` because variable binding for ``foo`` is not defined. Adding ``foo`` to ``ignored_query_parameters`` will allow the same request to be mapped to ``GetShelf``.\"\n        },\n        \"auto_mapping\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to route methods without the ``google.api.http`` option. Example : .. code-block:: proto     package bookstore;     service Bookstore {       rpc GetShelf(GetShelfRequest) returns (Shelf) {}     }     message GetShelfRequest {       int64 shelf = 1;     }     message Shelf {} The client could ``post`` a json body ``{\\\"shelf\\\": 1234}`` with the path of ``/bookstore.Bookstore/GetShelfRequest`` to call ``GetShelfRequest``.\"\n        },\n        \"ignore_unknown_query_parameters\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to ignore query parameters that cannot be mapped to a corresponding protobuf field. Use this if you cannot control the query parameters and do not know them beforehand. Otherwise use ``ignored_query_parameters``. Defaults to false.\"\n        },\n        \"convert_grpc_status\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to convert gRPC status headers to JSON. When trailer indicates a gRPC error and there was no HTTP body, take ``google.rpc.Status`` from the ``grpc-status-details-bin`` header and use it as JSON body. If there was no such header, make ``google.rpc.Status`` out of the ``grpc-status`` and ``grpc-message`` headers. The error details types must be present in the ``proto_descriptor``. For example, if an upstream server replies with headers: .. code-block:: none     grpc-status: 5     grpc-status-details-bin:         CAUaMwoqdHlwZS5nb29nbGVhcGlzLmNvbS9nb29nbGUucnBjLlJlcXVlc3RJbmZvEgUKA3ItMQ The ``grpc-status-details-bin`` header contains a base64-encoded protobuf message ``google.rpc.Status``. It will be transcoded into: .. code-block:: none     HTTP/1.1 404 Not Found     content-type: application/json     {\\\"code\\\":5,\\\"details\\\":[{\\\"@type\\\":\\\"type.googleapis.com/google.rpc.RequestInfo\\\",\\\"requestId\\\":\\\"r-1\\\"}]} In order to transcode the message, the ``google.rpc.RequestInfo`` type from the ``google/rpc/error_details.proto`` should be included in the configured :ref:`proto descriptor set `.\"\n        },\n        \"url_unescape_spec\": {\n          \"enum\": [\n            \"ALL_CHARACTERS_EXCEPT_RESERVED\",\n            0,\n            \"ALL_CHARACTERS_EXCEPT_SLASH\",\n            1,\n            \"ALL_CHARACTERS\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Url Unescape Spec\"\n        },\n        \"query_param_unescape_plus\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, unescape '+' to space when extracting variables in query parameters. This is to support `HTML 2.0 `_\"\n        },\n        \"match_unregistered_custom_verb\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, try to match the custom verb even if it is unregistered. By default, only match when it is registered. According to the http template `syntax `_, the custom verb is **\\\":\\\" LITERAL** at the end of http template. For a request with ``/foo/bar:baz`` and ``:baz`` is not registered in any url_template, here is the behavior change - if the field is not set, ``:baz`` will not be treated as custom verb, so it will match ``/foo/{x=*}``. - if the field is set, ``:baz`` is treated as custom verb,  so it will NOT match ``/foo/{x=*}`` since the template doesn't use any custom verb.\"\n        },\n        \"request_validation_options\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder.RequestValidationOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Configure the behavior when handling requests that cannot be transcoded. By default, the transcoder will silently pass through HTTP requests that are malformed. This includes requests with unknown query parameters, unregister paths, etc. Set these options to enable strict HTTP request validation, resulting in the transcoder rejecting such requests with a ``HTTP 4xx``. See each individual option for more details on the validation. gRPC requests will still silently pass through without transcoding. The benefit is a proper error message to the downstream. If the upstream is a gRPC server, it cannot handle the passed-through HTTP requests and will reset the TCP connection. The downstream will then receive a ``HTTP 503 Service Unavailable`` due to the upstream connection reset. This incorrect error message may conflict with other Envoy components, such as retry policies.\"\n        },\n        \"case_insensitive_enum_parsing\": {\n          \"type\": \"boolean\",\n          \"description\": \"Proto enum values are supposed to be in upper cases when used in JSON. Set this to true if your JSON request uses non uppercase enum values.\"\n        },\n        \"max_request_body_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum size of a request body to be transcoded, in bytes. A body exceeding this size will provoke a ``HTTP 413 Request Entity Too Large`` response. Large values may cause envoy to use a lot of memory if there are many concurrent requests. If unset, the current stream buffer size is used.\"\n        },\n        \"max_response_body_size\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum size of a response body to be transcoded, in bytes. A body exceeding this size will provoke a ``HTTP 500 Internal Server Error`` response. Large values may cause envoy to use a lot of memory if there are many concurrent requests. If unset, the current stream buffer size is used.\"\n        },\n        \"capture_unknown_query_parameters\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, query parameters that cannot be mapped to a corresponding protobuf field are captured in an HttpBody extension of UnknownQueryParams.\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: gRPC-JSON transcoder]\\n gRPC-JSON transcoder :ref:`configuration overview `.\\n [#extension: envoy.filters.http.grpc_json_transcoder]\",\n      \"description\": \"[#protodoc-title: gRPC-JSON transcoder] gRPC-JSON transcoder :ref:`configuration overview `. [#extension: envoy.filters.http.grpc_json_transcoder]  [#next-free-field: 18] GrpcJsonTranscoder filter configuration. The filter itself can be used per route / per virtual host or on the general level. The most specific one is being used for a given route. If the list of services is empty - filter is considered to be disabled. Note that if specifying the filter per route, first the route is matched, and then transcoding filter is applied. It matters when specifying the route configuration and paths to match the request - for per-route grpc transcoder configs, the original path should be matched, while in other cases, the grpc-like path is expected (the one AFTER the filter is applied).\"\n    },\n    \"envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder.PrintOptions\": {\n      \"properties\": {\n        \"add_whitespace\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to add spaces, line breaks and indentation to make the JSON output easy to read. Defaults to false.\"\n        },\n        \"always_print_primitive_fields\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to always print primitive fields. By default primitive fields with default values will be omitted in JSON output. For example, an int32 field set to 0 will be omitted. Setting this flag to true will override the default behavior and print primitive fields regardless of their values. Defaults to false.\"\n        },\n        \"always_print_enums_as_ints\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to always print enums as ints. By default they are rendered as strings. Defaults to false.\"\n        },\n        \"preserve_proto_field_names\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to preserve proto field names. By default protobuf will generate JSON field names using the ``json_name`` option, or lower camel case, in that order. Setting this flag will preserve the original field names. Defaults to false.\"\n        },\n        \"stream_newline_delimited\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, return all streams as newline-delimited JSON messages instead of as a comma-separated array\"\n        },\n        \"stream_sse_style_delimited\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, enforces Server-Sent Events (SSE) message framing (``data: \\\\n\\\\n``) and, ``stream_newline_delimited`` is ignored. If false, message framing is determined by ``stream_newline_delimited``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Print Options\",\n      \"description\": \"[#next-free-field: 7]\"\n    },\n    \"envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder.RequestValidationOptions\": {\n      \"properties\": {\n        \"reject_unknown_method\": {\n          \"type\": \"boolean\",\n          \"description\": \"By default, a request that cannot be mapped to any specified gRPC :ref:`services ` will pass-through this filter. When set to true, the request will be rejected with a ``HTTP 404 Not Found``.\"\n        },\n        \"reject_unknown_query_parameters\": {\n          \"type\": \"boolean\",\n          \"description\": \"By default, a request with query parameters that cannot be mapped to the gRPC request message will pass-through this filter. When set to true, the request will be rejected with a ``HTTP 400 Bad Request``. The fields :ref:`ignore_unknown_query_parameters `, :ref:`capture_unknown_query_parameters `, and :ref:`ignored_query_parameters ` have priority over this strict validation behavior.\"\n        },\n        \"reject_binding_body_field_collisions\": {\n          \"type\": \"boolean\",\n          \"title\": \"By default, transcoding will default to the value in the body if there\\n are conflict values in the bindings. For example,\\n\\n post: '/resources/a?id=123'\\n body: {\\n         id: 456,\\n }\",\n          \"description\": \"By default, transcoding will default to the value in the body if there are conflict values in the bindings. For example, post: '/resources/a?id=123' body: {         id: 456, }  \\\"id: 456\\\" in the body will override \\\"id=123\\\" in the binding. If this field is set to true, the request will be rejected if the binding value is different from the body value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Request Validation Options\"\n    },\n    \"HttpConnectionManager\": {\n      \"properties\": {\n        \"codec_type\": {\n          \"enum\": [\n            \"AUTO\",\n            0,\n            \"HTTP1\",\n            1,\n            \"HTTP2\",\n            2,\n            \"HTTP3\",\n            3\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Codec Type\"\n        },\n        \"stat_prefix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The human readable prefix to use when emitting statistics for the connection manager. See the :ref:`statistics documentation ` for more information.\"\n        },\n        \"rds\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.Rds\",\n          \"additionalProperties\": false,\n          \"description\": \"The connection manager\u2019s route table will be dynamically loaded via the RDS API.\"\n        },\n        \"route_config\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteConfiguration\",\n          \"additionalProperties\": false,\n          \"description\": \"The route table for the connection manager is static and is specified in this property.\"\n        },\n        \"scoped_routes\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes\",\n          \"additionalProperties\": false,\n          \"description\": \"A route table will be dynamically assigned to each request based on request attributes (e.g., the value of a header). The \\\"routing scopes\\\" (i.e., route tables) and \\\"scope keys\\\" are specified in this message.\"\n        },\n        \"http_filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of individual HTTP filters that make up the filter chain for requests made to the connection manager. :ref:`Order matters ` as the filters are processed sequentially as request events happen.\"\n        },\n        \"add_user_agent\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the connection manager manipulates the :ref:`config_http_conn_man_headers_user-agent` and :ref:`config_http_conn_man_headers_downstream-service-cluster` headers. See the linked documentation for more information. Defaults to false.\"\n        },\n        \"tracing\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing\",\n          \"additionalProperties\": false,\n          \"description\": \"Presence of the object defines whether the connection manager emits :ref:`tracing ` data to the :ref:`configured tracing provider `.\"\n        },\n        \"common_http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HttpProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional settings for HTTP requests handled by the connection manager. These will be applicable to both HTTP/1.1 and HTTP/2 requests.\"\n        },\n        \"http1_safe_max_connection_duration\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to ``true``, Envoy will not initiate an immediate drain timer for downstream HTTP/1 connections once :ref:`common_http_protocol_options.max_connection_duration ` is exceeded. Instead, Envoy will wait until the next downstream request arrives, add a ``connection: close`` header to the response, and then gracefully close the connection once the stream has completed. This behavior adheres to `RFC 9112, Section 9.6 `_. If set to ``false``, exceeding ``max_connection_duration`` triggers Envoy's default drain behavior for HTTP/1, where the connection is eventually closed after all active streams finish. This option has no effect if ``max_connection_duration`` is not configured. Defaults to ``false``.\"\n        },\n        \"http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional HTTP/1 settings that are passed to the HTTP/1 codec. [#comment:TODO: The following fields are ignored when the :ref:`header validation configuration ` is present: 1. :ref:`allow_chunked_length `]\"\n        },\n        \"http2_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http2ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional HTTP/2 settings that are passed directly to the HTTP/2 codec.\"\n        },\n        \"http3_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http3ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional HTTP/3 settings that are passed directly to the HTTP/3 codec.\"\n        },\n        \"server_name\": {\n          \"type\": \"string\",\n          \"description\": \"An optional override that the connection manager will write to the server header in responses. If not set, the default is ``envoy``.\"\n        },\n        \"server_header_transformation\": {\n          \"enum\": [\n            \"OVERWRITE\",\n            0,\n            \"APPEND_IF_ABSENT\",\n            1,\n            \"PASS_THROUGH\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Server Header Transformation\"\n        },\n        \"scheme_header_transformation\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SchemeHeaderTransformation\",\n          \"additionalProperties\": false,\n          \"description\": \"Allows for explicit transformation of the :scheme header on the request path. If not set, Envoy's default :ref:`scheme  ` handling applies.\"\n        },\n        \"max_request_headers_kb\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum request headers size for incoming connections. If unconfigured, the default max request headers allowed is 60 KiB. The default value can be overridden by setting runtime key ``envoy.reloadable_features.max_request_headers_size_kb``. Requests that exceed this limit will receive a 431 response. .. note::   Currently some protocol codecs impose limits on the maximum size of a single header.   * HTTP/2 (when using nghttp2) limits a single header to around 100 KB by default. This can be     adjusted via :ref:`max_header_field_size_kb     `.   * HTTP/3 limits a single header to around 1024 KB.\"\n        },\n        \"stream_idle_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The stream idle timeout for connections managed by the connection manager. If not specified, this defaults to ``5 minutes``. The default value was selected so as not to interfere with any smaller configured timeouts that may have existed in configurations prior to the introduction of this feature, while introducing robustness to TCP connections that terminate without a FIN. This idle timeout applies to new streams and is overridable by the :ref:`route-level idle_timeout `. Even on a stream in which the override applies, prior to receipt of the initial request headers, the ``stream_idle_timeout`` applies. Each time an encode/decode event for headers or data is processed for the stream, the timer will be reset. If the timeout fires, the stream is terminated with a ``408 Request Timeout`` error code if no upstream response header has been received, otherwise a stream reset occurs. If the :ref:`overload action ` ``envoy.overload_actions.reduce_timeouts`` is configured, this timeout is scaled according to the value for :ref:`HTTP_DOWNSTREAM_STREAM_IDLE `. .. note::   It is possible to idle timeout even if the wire traffic for a stream is non-idle, due   to the granularity of events presented to the connection manager. For example, while receiving   very large request headers, it may be the case that there is traffic regularly arriving on the   wire while the connection manager is only able to observe the end-of-headers event, hence the   stream may still idle timeout. A value of ``0`` will completely disable the connection manager stream idle timeout, although per-route idle timeout overrides will continue to apply. This timeout is also used as the default value for :ref:`stream_flush_timeout `.\",\n          \"format\": \"regex\"\n        },\n        \"stream_flush_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The stream flush timeout for connections managed by the connection manager. If not specified, the value of stream_idle_timeout is used. This is for backwards compatibility since this was the original behavior. In essence this timeout is an override for the stream_idle_timeout that applies specifically to the end of stream flush case. This timeout specifies the amount of time that Envoy will wait for the peer to open enough window to write any remaining stream data once the entirety of stream data (local end stream is true) has been buffered pending available window. In other words, this timeout defends against a peer that does not release enough window to completely write the stream, even though all data has been proxied within available flow control windows. If the timeout is hit in this case, the :ref:`tx_flush_timeout ` counter will be incremented. Note that :ref:`max_stream_duration ` does not apply to this corner case.\",\n          \"format\": \"regex\"\n        },\n        \"request_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The amount of time that Envoy will wait for the entire request to be received. The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent upstream (i.e. all decoding filters have processed the request), OR when the response is initiated. If not specified or set to 0, this timeout is disabled.\",\n          \"format\": \"regex\"\n        },\n        \"request_headers_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The amount of time that Envoy will wait for the request headers to be received. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. If not specified or set to 0, this timeout is disabled.\",\n          \"format\": \"regex\"\n        },\n        \"drain_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The time that Envoy will wait between sending an HTTP/2 \u201cshutdown notification\u201d (GOAWAY frame with max stream ID) and a final GOAWAY frame. This is used so that Envoy provides a grace period for new streams that race with the final GOAWAY frame. During this grace period, Envoy will continue to accept new streams. After the grace period, a final GOAWAY frame is sent and Envoy will start refusing new streams. Draining occurs either when a connection hits the idle timeout, when :ref:`max_connection_duration ` is reached, or during general server draining. The default grace period is 5000 milliseconds (5 seconds) if this option is not specified.\",\n          \"format\": \"regex\"\n        },\n        \"drain_timeout_jitter\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Percentage-based jitter for ``drain_timeout``. If set, the actual drain grace period is extended by a random duration up to ``drain_timeout * jitter / 100`` per connection. This staggers the final GOAWAY (and connection close) across time so that connections entering the drain state simultaneously do not all complete draining at the same instant, mitigating thundering-herd reconnects. If not set, no jitter is added. This is analogous to :ref:`max_connection_duration_jitter `, but applied to the drain grace timer rather than the connection duration timer.\"\n        },\n        \"delayed_close_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The delayed close timeout is for downstream connections managed by the HTTP connection manager. It is defined as a grace period after connection close processing has been locally initiated during which Envoy will wait for the peer to close (i.e., a TCP FIN/RST is received by Envoy from the downstream connection) prior to Envoy closing the socket associated with that connection. .. note::   This timeout is enforced even when the socket associated with the downstream connection is pending a flush of   the write buffer. However, any progress made writing data to the socket will restart the timer associated with   this timeout. This means that the total grace period for a socket in this state will be   +. Delaying Envoy's connection close and giving the peer the opportunity to initiate the close sequence mitigates a race condition that exists when downstream clients do not drain/process data in a connection's receive buffer after a remote close has been detected via a socket ``write()``. This race leads to such clients failing to process the response code sent by Envoy, which could result in erroneous downstream processing. If the timeout triggers, Envoy will close the connection's socket. The default timeout is 1000 ms if this option is not specified. .. note::    To be useful in avoiding the race condition described above, this timeout must be set    to *at least* +<100ms to account for    a reasonable \\\"worst\\\" case processing time for a full iteration of Envoy's event loop>. .. warning::    A value of ``0`` will completely disable delayed close processing. When disabled, the downstream    connection's socket will be closed immediately after the write flush is completed or will    never close if the write flush does not complete.\",\n          \"format\": \"regex\"\n        },\n        \"access_log\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLog\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration for :ref:`HTTP access logs ` emitted by the connection manager.\"\n        },\n        \"access_log_flush_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval to flush the above access logs. .. attention::   This field is deprecated in favor of   :ref:`access_log_flush_interval   `.   Note that if both this field and :ref:`access_log_flush_interval   `   are specified, the former (deprecated field) is ignored.\",\n          \"format\": \"regex\"\n        },\n        \"flush_access_log_on_new_request\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, HCM will flush an access log once when a new HTTP request is received, after the request headers have been evaluated, and before iterating through the HTTP filter chain. .. attention::   This field is deprecated in favor of   :ref:`flush_access_log_on_new_request   `.   Note that if both this field and :ref:`flush_access_log_on_new_request   `   are specified, the former (deprecated field) is ignored.\"\n        },\n        \"access_log_options\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.HcmAccessLogOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional access log options for HTTP connection manager.\"\n        },\n        \"use_remote_address\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, the connection manager will use the real remote address of the client connection when determining internal versus external origin and manipulating various headers. If set to false or absent, the connection manager will use the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. See the documentation for :ref:`config_http_conn_man_headers_x-forwarded-for`, :ref:`config_http_conn_man_headers_x-envoy-internal`, and :ref:`config_http_conn_man_headers_x-envoy-external-address` for more information.\"\n        },\n        \"xff_num_trusted_hops\": {\n          \"type\": \"integer\",\n          \"description\": \"The number of additional ingress proxy hops from the right side of the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header to trust when determining the origin client's IP address. The default is zero if this option is not specified. See the documentation for :ref:`config_http_conn_man_headers_x-forwarded-for` for more information.\"\n        },\n        \"original_ip_detection_extensions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration for original IP detection extensions. When these extensions are configured, Envoy will invoke them with the incoming request headers and details about the downstream connection, including the directly connected address. Each extension uses this information to determine the effective remote IP address for the request. If an extension cannot identify the original IP address and isn't set to reject the request, Envoy will sequentially attempt the remaining extensions until one successfully determines the IP or explicitly rejects the request. If all extensions fail without rejection, Envoy defaults to using the directly connected remote address. .. warning::    These extensions cannot be configured simultaneously with :ref:`use_remote_address    `    or :ref:`xff_num_trusted_hops    `. [#extension-category: envoy.http.original_ip_detection]\"\n        },\n        \"early_header_mutation_extensions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The configuration for the early header mutation extensions. When configured the extensions will be called before any routing, tracing, or any filter processing. Each extension will be applied in the order they are configured. If the same header is mutated by multiple extensions, then the last extension will win. [#extension-category: envoy.http.early_header_mutation]\"\n        },\n        \"internal_address_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configures what network addresses are considered internal for stats and header sanitation purposes. If unspecified, only RFC1918 IP addresses will be considered internal. See the documentation for :ref:`config_http_conn_man_headers_x-envoy-internal` for more information about internal/external addresses. .. warning::     As of Envoy 1.33.0 no IP addresses will be considered trusted. If you have tooling such as probes     on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers)     you will have to manually include those addresses or CIDR ranges like: .. validated-code-block:: yaml   :type-name: envoy.extensions.filters.network.http_connection_manager.v3.InternalAddressConfig   cidr_ranges:       address_prefix: 10.0.0.0       prefix_len: 8   cidr_ranges:       address_prefix: 192.168.0.0       prefix_len: 16   cidr_ranges:       address_prefix: 172.16.0.0       prefix_len: 12   cidr_ranges:       address_prefix: 127.0.0.1       prefix_len: 32   cidr_ranges:       address_prefix: fd00::       prefix_len: 8   cidr_ranges:       address_prefix: ::1       prefix_len: 128\"\n        },\n        \"skip_xff_append\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set, Envoy will not append the remote address to the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. This may be used in conjunction with HTTP filters that explicitly manipulate XFF after the HTTP connection manager has mutated the request headers. While :ref:`use_remote_address ` will also suppress XFF addition, it has consequences for logging and other Envoy uses of the remote address, so ``skip_xff_append`` should be used when only an elision of XFF addition is intended.\"\n        },\n        \"via\": {\n          \"type\": \"string\",\n          \"description\": \"Via header value to append to request and response headers. If this is empty, no via header will be appended.\"\n        },\n        \"generate_request_id\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the connection manager will generate the :ref:`x-request-id ` header if it does not exist. This defaults to true. Generating a random UUID4 is expensive so in high throughput scenarios where this feature is not desired it can be disabled.\"\n        },\n        \"preserve_external_request_id\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether the connection manager will keep the :ref:`x-request-id ` header if passed for a request that is edge (Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour. This defaults to false.\"\n        },\n        \"always_set_request_id_in_response\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set, Envoy will always set :ref:`x-request-id ` header in response. If this is false or not set, the request ID is returned in responses only if tracing is forced using :ref:`x-envoy-force-trace ` header.\"\n        },\n        \"forward_client_cert_details\": {\n          \"enum\": [\n            \"SANITIZE\",\n            0,\n            \"FORWARD_ONLY\",\n            1,\n            \"APPEND_FORWARD\",\n            2,\n            \"SANITIZE_SET\",\n            3,\n            \"ALWAYS_FORWARD_ONLY\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Forward Client Cert Details\",\n          \"description\": \"How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP header.\"\n        },\n        \"set_current_client_cert_details\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails\",\n          \"additionalProperties\": false,\n          \"description\": \"This field is valid only when :ref:`forward_client_cert_details ` is APPEND_FORWARD or SANITIZE_SET and the client connection is mTLS. It specifies the fields in the client certificate to be forwarded. Note that in the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` header, ``Hash`` is always set, and ``By`` is always set when the client certificate presents the URI type Subject Alternative Name value.\"\n        },\n        \"forward_client_cert_matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The matcher for forwarding client cert details. This allows per-request configuration of forward client cert behavior based on request properties. If a matcher is configured and matches a request, the matched action's forward client cert config will be used. If the matcher is not configured or doesn't match, the static :ref:`forward_client_cert_details ` and :ref:`set_current_client_cert_details ` config will be used as fallback. Example: If the x-forwarded-client-cert header contains \\\"trusted-client\\\", use APPEND_FORWARD, otherwise use SANITIZE_SET: .. code-block:: yaml   forward_client_cert_matcher:     matcher_list:       matchers:       - predicate:           single_predicate:             input:               name: envoy.matching.inputs.request_headers               typed_config:                 \\\"@type\\\": type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput                 header_name: \\\"x-forwarded-client-cert\\\"             value_match:               string_match:                 contains: \\\"trusted-client\\\"         on_match:           action:             name: forward_client_cert             typed_config:               \\\"@type\\\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertConfig               forward_client_cert_details: APPEND_FORWARD               set_current_client_cert_details:                 uri: true     on_no_match:       action:         name: forward_client_cert         typed_config:           \\\"@type\\\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertConfig           forward_client_cert_details: SANITIZE_SET           set_current_client_cert_details:             uri: true\"\n        },\n        \"proxy_100_continue\": {\n          \"type\": \"boolean\",\n          \"description\": \"If proxy_100_continue is true, Envoy will proxy incoming \\\"Expect: 100-continue\\\" headers upstream, and forward \\\"100 Continue\\\" responses downstream. If this is false or not set, Envoy will instead strip the \\\"Expect: 100-continue\\\" header, and send a \\\"100 Continue\\\" response itself.\"\n        },\n        \"represent_ipv4_remote_address_as_ipv4_mapped_ipv6\": {\n          \"type\": \"boolean\",\n          \"description\": \"If :ref:`use_remote_address ` is true and represent_ipv4_remote_address_as_ipv4_mapped_ipv6 is true and the remote address is an IPv4 address, the address will be mapped to IPv6 before it is appended to ``x-forwarded-for``. This is useful for testing compatibility of upstream services that parse the header value. For example, 50.0.0.1 is represented as ::FFFF:50.0.0.1. See `IPv4-Mapped IPv6 Addresses `_ for details. This will also affect the :ref:`config_http_conn_man_headers_x-envoy-external-address` header. See :ref:`http_connection_manager.represent_ipv4_remote_address_as_ipv4_mapped_ipv6 ` for runtime control. [#not-implemented-hide:]\"\n        },\n        \"upgrade_configs\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        },\n        \"normalize_path\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Should paths be normalized according to RFC 3986 before any processing of requests by HTTP filters or routing? This affects the upstream ``:path`` header as well. For paths that fail this check, Envoy will respond with 400 to paths that are malformed. This defaults to false currently but will default true in the future. When not specified, this value may be overridden by the runtime variable :ref:`http_connection_manager.normalize_path`. See `Normalization and Comparison `_ for details of normalization. Note that Envoy does not perform `case normalization `_ [#comment:TODO: This field is ignored when the :ref:`header validation configuration ` is present.]\"\n        },\n        \"merge_slashes\": {\n          \"type\": \"boolean\",\n          \"description\": \"Determines if adjacent slashes in the path are merged into one before any processing of requests by HTTP filters or routing. This affects the upstream ``:path`` header as well. Without setting this option, incoming requests with path ``//dir///file`` will not match against route with ``prefix`` match set to ``/dir``. Defaults to ``false``. Note that slash merging is not part of `HTTP spec `_ and is provided for convenience. [#comment:TODO: This field is ignored when the :ref:`header validation configuration ` is present.]\"\n        },\n        \"path_with_escaped_slashes_action\": {\n          \"enum\": [\n            \"IMPLEMENTATION_SPECIFIC_DEFAULT\",\n            0,\n            \"KEEP_UNCHANGED\",\n            1,\n            \"REJECT_REQUEST\",\n            2,\n            \"UNESCAPE_AND_REDIRECT\",\n            3,\n            \"UNESCAPE_AND_FORWARD\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Path With Escaped Slashes Action\",\n          \"description\": \"Determines the action for request that contain ``%2F``, ``%2f``, ``%5C`` or ``%5c`` sequences in the URI path. This operation occurs before URL normalization and the merge slashes transformations if they were enabled.\"\n        },\n        \"request_id_extension\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension\",\n          \"additionalProperties\": false,\n          \"description\": \"The configuration of the request ID extension. This includes operations such as generation, validation, and associated tracing operations. If empty, the :ref:`UuidRequestIdConfig ` default extension is used with default parameters. See the documentation for that extension for details on what it does. Customizing the configuration for the default extension can be achieved by configuring it explicitly here. For example, to disable trace reason packing, the following configuration can be used: .. validated-code-block:: yaml   :type-name: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension   typed_config:     \\\"@type\\\": type.googleapis.com/envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig     pack_trace_reason: false [#extension-category: envoy.request_id]\"\n        },\n        \"local_reply_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"The configuration to customize local reply returned by Envoy. It can customize status code, body text and response content type. If not specified, status code and text body are hard coded in Envoy, the response content type is plain text.\"\n        },\n        \"strip_matching_host_port\": {\n          \"type\": \"boolean\",\n          \"description\": \"Determines if the port part should be removed from host/authority header before any processing of request by HTTP filters or routing. The port would be removed only if it is equal to the :ref:`listener's` local port. This affects the upstream host header unless the method is CONNECT in which case if no filter adds a port the original port will be restored before headers are sent upstream. Without setting this option, incoming requests with host ``example:443`` will not match against route with :ref:`domains` match set to ``example``. Defaults to ``false``. Note that port removal is not part of `HTTP spec `_ and is provided for convenience. Only one of ``strip_matching_host_port`` or ``strip_any_host_port`` can be set.\"\n        },\n        \"strip_any_host_port\": {\n          \"type\": \"boolean\",\n          \"description\": \"Determines if the port part should be removed from host/authority header before any processing of request by HTTP filters or routing. This affects the upstream host header unless the method is CONNECT in which case if no filter adds a port the original port will be restored before headers are sent upstream. Without setting this option, incoming requests with host ``example:443`` will not match against route with :ref:`domains` match set to ``example``. Defaults to ``false``. Note that port removal is not part of `HTTP spec `_ and is provided for convenience. Only one of ``strip_matching_host_port`` or ``strip_any_host_port`` can be set.\"\n        },\n        \"stream_error_on_invalid_http_message\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Governs Envoy's behavior when receiving invalid HTTP from downstream. If this option is false (default), Envoy will err on the conservative side handling HTTP errors, terminating both HTTP/1.1 and HTTP/2 connections when receiving an invalid request. If this option is set to true, Envoy will be more permissive, only resetting the invalid stream in the case of HTTP/2 and leaving the connection open where possible (if the entire request is read for HTTP/1.1) In general this should be true for deployments receiving trusted traffic (L2 Envoys, company-internal mesh) and false when receiving untrusted traffic (edge deployments). If different behaviors for invalid_http_message for HTTP/1 and HTTP/2 are desired, one should use the new HTTP/1 option :ref:`override_stream_error_on_invalid_http_message ` or the new HTTP/2 option :ref:`override_stream_error_on_invalid_http_message ` ``not`` the deprecated but similarly named :ref:`stream_error_on_invalid_http_messaging `\"\n        },\n        \"path_normalization_options\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] Path normalization configuration. This includes configurations for transformations (e.g. RFC 3986 normalization or merge adjacent slashes) and the policy to apply them. The policy determines whether transformations affect the forwarded ``:path`` header. RFC 3986 path normalization is enabled by default and the default policy is that the normalized header will be forwarded. See :ref:`PathNormalizationOptions ` for details.\"\n        },\n        \"strip_trailing_host_dot\": {\n          \"type\": \"boolean\",\n          \"description\": \"Determines if trailing dot of the host should be removed from host/authority header before any processing of request by HTTP filters or routing. This affects the upstream host header. Without setting this option, incoming requests with host ``example.com.`` will not match against route with :ref:`domains` match set to ``example.com``. Defaults to ``false``. When the incoming request contains a host/authority header that includes a port number, setting this option will strip a trailing dot, if present, from the host section, leaving the port as is (e.g. host value ``example.com.:443`` will be updated to ``example.com:443``).\"\n        },\n        \"proxy_status_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Proxy-Status HTTP response header configuration. If this config is set, the Proxy-Status HTTP response header field is populated. By default, it is not.\"\n        },\n        \"typed_header_validation_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration options for Header Validation (UHV). UHV is an extensible mechanism for checking validity of HTTP requests as well as providing normalization for request attributes, such as URI path. If the typed_header_validation_config is present it overrides the following options: ``normalize_path``, ``merge_slashes``, ``path_with_escaped_slashes_action`` ``http_protocol_options.allow_chunked_length``, ``common_http_protocol_options.headers_with_underscores_action``. The default UHV checks the following: #. HTTP/1 header map validity according to `RFC 7230 section 3.2`_ #. Syntax of HTTP/1 request target URI and response status #. HTTP/2 header map validity according to `RFC 7540 section 8.1.2`_ #. Syntax of HTTP/3 pseudo headers #. Syntax of ``Content-Length`` and ``Transfer-Encoding`` #. Validation of HTTP/1 requests with both ``Content-Length`` and ``Transfer-Encoding`` headers #. Normalization of the URI path according to `Normalization and Comparison `_    without `case normalization `_ [#not-implemented-hide:] [#extension-category: envoy.http.header_validators]\"\n        },\n        \"append_x_forwarded_port\": {\n          \"type\": \"boolean\",\n          \"description\": \"Append the ``x-forwarded-port`` header with the port value client used to connect to Envoy. It will be ignored if the ``x-forwarded-port`` header has been set by any trusted proxy in front of Envoy.\"\n        },\n        \"append_local_overload\": {\n          \"type\": \"boolean\",\n          \"description\": \"Append the :ref:`config_http_conn_man_headers_x-envoy-local-overloaded` HTTP header in the scenario where the Overload Manager has been triggered.\"\n        },\n        \"add_proxy_protocol_connection_state\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the HCM will add ProxyProtocolFilterState to the Connection lifetime filter state. Defaults to ``true``. This should be set to ``false`` in cases where Envoy's view of the downstream address may not correspond to the actual client address, for example, if there's another proxy in front of the Envoy.\"\n        },\n        \"forward_proto_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ForwardProtoConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for controlling how the ``x-forwarded-proto`` header is set. This allows customization of protocol inference, including support for inferring the original protocol (HTTP or HTTPS) from the PROXY protocol destination port. This is useful when a Layer 4 load balancer (such as AWS NLB) terminates TLS and uses PROXY protocol to communicate with Envoy. When configured and the local address was restored from PROXY protocol (indicating the original destination address is available), the ``x-forwarded-proto`` header will be set based on whether the destination port is in ``https_destination_ports`` or ``http_destination_ports``. Example configuration: .. code-block:: yaml   http_connection_manager:     forward_proto_config:       https_destination_ports: [443, 8443]       http_destination_ports: [80, 8080] If not configured, defaults to disabled and the standard behavior applies (using connection TLS status or trusted downstream headers).\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: HTTP connection manager]\\n HTTP connection manager :ref:`configuration overview `.\\n [#extension: envoy.filters.network.http_connection_manager]\",\n      \"description\": \"[#protodoc-title: HTTP connection manager] HTTP connection manager :ref:`configuration overview `. [#extension: envoy.filters.network.http_connection_manager]  [#next-free-field: 63]\"\n    },\n    \"envoy.config.common.mutation_rules.v3.HeaderMutation\": {\n      \"properties\": {\n        \"remove\": {\n          \"type\": \"string\",\n          \"description\": \"Remove the specified header if it exists.\"\n        },\n        \"append\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\",\n          \"additionalProperties\": false,\n          \"description\": \"Append new header by the specified HeaderValueOption.\"\n        },\n        \"remove_on_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.mutation_rules.v3.HeaderMutation.RemoveOnMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"Remove the header if the key matches the specified string matcher.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Mutation\",\n      \"description\": \"The HeaderMutation structure specifies an action that may be taken on HTTP headers.\"\n    },\n    \"envoy.config.common.mutation_rules.v3.HeaderMutation.RemoveOnMatch\": {\n      \"properties\": {\n        \"key_matcher\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"A string matcher that will be applied to the header key. If the header key matches, the header will be removed.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Remove On Match\"\n    },\n    \"envoy.config.core.v3.Http3ProtocolOptions\": {\n      \"properties\": {\n        \"quic_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.QuicProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"override_stream_error_on_invalid_http_message\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Allows invalid HTTP messaging and headers. When this option is disabled (default), then the whole HTTP/3 connection is terminated upon receiving invalid HEADERS frame. However, when this option is enabled, only the offending stream is terminated. If set, this overrides any HCM :ref:`stream_error_on_invalid_http_messaging `.\"\n        },\n        \"allow_extended_connect\": {\n          \"type\": \"boolean\",\n          \"description\": \"Allows proxying Websocket and other upgrades over HTTP/3 CONNECT using the header mechanisms from the `HTTP/2 extended connect RFC `_ and settings `proposed for HTTP/3 `_ .. note::   HTTP/3 CONNECT is not yet an RFC.\"\n        },\n        \"allow_metadata\": {\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Hiding until Envoy has full metadata support. Still under implementation. DO NOT USE. Allows sending and receiving HTTP/3 METADATA frames. See [metadata docs](https://github.com/envoyproxy/envoy/blob/main/source/docs/h2_metadata.md) for more information.\"\n        },\n        \"disable_qpack\": {\n          \"type\": \"boolean\",\n          \"description\": \"[#not-implemented-hide:] Hiding until Envoy has full HTTP/3 upstream support. Still under implementation. DO NOT USE. Disables QPACK compression related features for HTTP/3 including: No huffman encoding, zero dynamic table capacity and no cookie crumbling. This can be useful for trading off CPU vs bandwidth when an upstream HTTP/3 connection multiplexes multiple downstream connections.\"\n        },\n        \"disable_connection_flow_control_for_streams\": {\n          \"type\": \"boolean\",\n          \"description\": \"Disables connection level flow control for HTTP/3 streams. This is useful in situations where the streams share the same connection but originate from different end-clients, so that each stream can make progress independently at non-front-line proxies.\"\n        },\n        \"disallow_obs_text\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether to disallow obsolete text in header field values. If not set, it defaults to true for alignment with current behavior. As defined in RFC 9110, https://www.rfc-editor.org/rfc/rfc9110.html#section-5.5: an obs-text character is a character in the range %x80-FF\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http 3 Protocol Options\",\n      \"description\": \"A message which allows using HTTP/3. [#next-free-field: 10]\"\n    },\n    \"envoy.config.core.v3.RuntimeFractionalPercent\": {\n      \"properties\": {\n        \"default_value\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Default value if the runtime value's for the numerator/denominator keys are not available.\"\n        },\n        \"runtime_key\": {\n          \"type\": \"string\",\n          \"description\": \"Runtime key for a YAML representation of a FractionalPercent.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Runtime Fractional Percent\",\n      \"description\": \"Runtime derived FractionalPercent with defaults for when the numerator or denominator is not specified via a runtime key. .. note::   Parsing of the runtime key's data is implemented such that it may be represented as a   :ref:`FractionalPercent ` proto represented as JSON/YAML   and may also be represented as an integer with the assumption that the value is an integral   percentage out of 100. For instance, a runtime key lookup returning the value \\\"42\\\" would parse   as a ``FractionalPercent`` whose numerator is 42 and denominator is HUNDRED.\"\n    },\n    \"envoy.config.core.v3.SchemeHeaderTransformation\": {\n      \"properties\": {\n        \"scheme_to_overwrite\": {\n          \"type\": \"string\",\n          \"description\": \"Overwrite any Scheme header with the contents of this string. If set, takes precedence over ``match_upstream``.\"\n        },\n        \"match_upstream\": {\n          \"type\": \"boolean\",\n          \"description\": \"Set the Scheme header to match the upstream transport protocol. For example, should a request be sent to the upstream over TLS, the scheme header will be set to ``\\\"https\\\"``. Should the request be sent over plaintext, the scheme header will be set to ``\\\"http\\\"``. If ``scheme_to_overwrite`` is set, this field is not used.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Scheme Header Transformation\",\n      \"description\": \"A message to control transformations to the :scheme header\"\n    },\n    \"envoy.config.route.v3.ClusterSpecifierPlugin\": {\n      \"properties\": {\n        \"extension\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"The name of the plugin and its opaque configuration. [#extension-category: envoy.router.cluster_specifier_plugin]\"\n        },\n        \"is_optional\": {\n          \"type\": \"boolean\",\n          \"description\": \"If is_optional is not set or is set to false and the plugin defined by this message is not a supported type, the containing resource is NACKed. If is_optional is set to true, the resource would not be NACKed for this reason. In this case, routes referencing this plugin's name would not be treated as an illegal configuration, but would result in a failure if the route is selected.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cluster Specifier Plugin\",\n      \"description\": \"Configuration for a cluster specifier plugin.\"\n    },\n    \"envoy.config.route.v3.CookieMatcher\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Specifies the cookie name to evaluate.\"\n        },\n        \"string_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Match the cookie value using :ref:`StringMatcher ` semantics.\"\n        },\n        \"invert_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"Invert the match result. If the cookie is not present, the match result is false, so ``invert_match`` will cause the matcher to succeed when the cookie is absent.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cookie Matcher\",\n      \"description\": \"Cookie matching inspects individual name/value pairs parsed from the ``Cookie`` header.\"\n    },\n    \"envoy.config.route.v3.CorsPolicy\": {\n      \"properties\": {\n        \"allow_origin_string_match\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies string patterns that match allowed origins. An origin is allowed if any of the string matchers match.\"\n        },\n        \"allow_methods\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the content for the ``access-control-allow-methods`` header.\"\n        },\n        \"allow_headers\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the content for the ``access-control-allow-headers`` header.\"\n        },\n        \"expose_headers\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the content for the ``access-control-expose-headers`` header.\"\n        },\n        \"max_age\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the content for the ``access-control-max-age`` header.\"\n        },\n        \"allow_credentials\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Specifies whether the resource allows credentials.\"\n        },\n        \"filter_enabled\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeFractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the % of requests for which the CORS filter is enabled. If neither ``enabled``, ``filter_enabled``, nor ``shadow_enabled`` are specified, the CORS filter will be enabled for 100% of the requests. If :ref:`runtime_key ` is specified, Envoy will lookup the runtime key to get the percentage of requests to filter.\"\n        },\n        \"shadow_enabled\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeFractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the % of requests for which the CORS policies will be evaluated and tracked, but not enforced. This field is intended to be used when ``filter_enabled`` and ``enabled`` are off. One of those fields have to explicitly disable the filter in order for this setting to take effect. If :ref:`runtime_key ` is specified, Envoy will lookup the runtime key to get the percentage of requests for which it will evaluate and track the request's ``Origin`` to determine if it's valid but will not enforce any policies.\"\n        },\n        \"allow_private_network_access\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Specify whether allow requests whose target server's IP address is more private than that from which the request initiator was fetched. More details refer to https://developer.chrome.com/blog/private-network-access-preflight.\"\n        },\n        \"forward_not_matching_preflights\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Specifies if preflight requests not matching the configured allowed origin should be forwarded to the upstream. Default is ``true``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cors Policy\",\n      \"description\": \"Cors policy configuration. .. attention::   This message has been deprecated. Please use   :ref:`CorsPolicy in filter extension `   as as alternative. [#next-free-field: 14]\"\n    },\n    \"envoy.config.route.v3.Decorator\": {\n      \"properties\": {\n        \"operation\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The operation name associated with the request matched to this route. If tracing is enabled, this information will be used as the span name reported for this request. .. note::   For ingress (inbound) requests, or egress (outbound) responses, this value may be overridden   by the :ref:`x-envoy-decorator-operation   ` header.\"\n        },\n        \"propagate\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the decorated details should be propagated to the other party. The default is ``true``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Decorator\"\n    },\n    \"envoy.config.route.v3.DirectResponseAction\": {\n      \"properties\": {\n        \"status\": {\n          \"type\": \"integer\",\n          \"description\": \"Specifies the HTTP response status to be returned.\"\n        },\n        \"body\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the content of the response body. If this setting is omitted, no body is included in the generated response. .. note::   Headers can be specified using ``response_headers_to_add`` in the enclosing   :ref:`envoy_v3_api_msg_config.route.v3.Route`, :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration` or   :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`.\"\n        },\n        \"body_format\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SubstitutionFormatString\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies a format string for the response body. If present, the contents of ``body_format`` will be formatted and used as the response body, where the contents of ``body`` (may be empty) will be passed as the variable ``%LOCAL_REPLY_BODY%``. If neither are provided, no body is included in the generated response.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Direct Response Action\"\n    },\n    \"envoy.config.route.v3.FilterAction\": {\n      \"properties\": {\n        \"action\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Filter Action\",\n      \"description\": \"A filter-defined action type.\"\n    },\n    \"envoy.config.route.v3.HedgePolicy\": {\n      \"properties\": {\n        \"initial_requests\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Specifies the number of initial requests that should be sent upstream. Must be at least 1. Defaults to 1. [#not-implemented-hide:]\"\n        },\n        \"additional_request_chance\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies a probability that an additional upstream request should be sent on top of what is specified by initial_requests. Defaults to 0. [#not-implemented-hide:]\"\n        },\n        \"hedge_on_per_try_timeout\": {\n          \"type\": \"boolean\",\n          \"description\": \"Indicates that a hedged request should be sent when the per-try timeout is hit. This means that a retry will be issued without resetting the original request, leaving multiple upstream requests in flight. The first request to complete successfully will be the one returned to the caller. * At any time, a successful response (i.e. not triggering any of the retry-on conditions) would be returned to the client. * Before per-try timeout, an error response (per retry-on conditions) would be retried immediately or returned to the client   if there are no more retries left. * After per-try timeout, an error response would be discarded, as a retry in the form of a hedged request is already in progress. .. note::   For this to have effect, you must have a :ref:`RetryPolicy ` that retries at least   one error code and specifies a maximum number of retries. Defaults to ``false``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Hedge Policy\",\n      \"description\": \"HTTP request hedging :ref:`architecture overview `.\"\n    },\n    \"envoy.config.route.v3.InternalRedirectPolicy\": {\n      \"properties\": {\n        \"max_internal_redirects\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"An internal redirect is not handled, unless the number of previous internal redirects that a downstream request has encountered is lower than this value. In the case where a downstream request is bounced among multiple routes by internal redirect, the first route that hits this threshold, or does not set :ref:`internal_redirect_policy ` will pass the redirect back to downstream. If not specified, at most one redirect will be followed.\"\n        },\n        \"redirect_response_codes\": {\n          \"items\": {\n            \"type\": \"integer\"\n          },\n          \"maxItems\": 5,\n          \"type\": \"array\",\n          \"description\": \"Defines what upstream response codes are allowed to trigger internal redirect. If unspecified, only 302 will be treated as internal redirect. Only 301, 302, 303, 307 and 308 are valid values. Any other codes will be ignored.\"\n        },\n        \"predicates\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of predicates that are queried when an upstream response is deemed to trigger an internal redirect by all other criteria. Any predicate in the list can reject the redirect, causing the response to be proxied to downstream. [#extension-category: envoy.internal_redirect_predicates]\"\n        },\n        \"allow_cross_scheme_redirect\": {\n          \"type\": \"boolean\",\n          \"description\": \"Allow internal redirect to follow a target URI with a different scheme than the value of x-forwarded-proto. The default is ``false``.\"\n        },\n        \"response_headers_to_copy\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of headers, by name, to copy from the internal redirect into the subsequent request. If a header is specified here but not present in the redirect, it will be cleared in the subsequent request.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Internal Redirect Policy\",\n      \"description\": \"HTTP Internal Redirect :ref:`architecture overview `. [#next-free-field: 6]\"\n    },\n    \"envoy.config.route.v3.NonForwardingAction\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Non Forwarding Action\",\n      \"description\": \"[#not-implemented-hide:]\"\n    },\n    \"envoy.config.route.v3.QueryParameterMatcher\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Specifies the name of a key that must be present in the requested ``path``'s query string.\"\n        },\n        \"string_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies whether a query parameter value should match against a string.\"\n        },\n        \"present_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"Specifies whether a query parameter should be present.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Query Parameter Matcher\",\n      \"description\": \"Query parameter matching treats the query string of a request's :path header as an ampersand-separated list of keys and/or key=value elements. [#next-free-field: 7]\"\n    },\n    \"envoy.config.route.v3.RateLimit\": {\n      \"properties\": {\n        \"stage\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Refers to the stage set in the filter. The rate limit configuration only applies to filters with the same stage number. The default stage number is 0. .. note::   The filter supports a range of 0 - 10 inclusively for stage numbers. .. note::   This is not supported if the rate limit action is configured in the ``typed_per_filter_config`` like   :ref:`VirtualHost.typed_per_filter_config` or   :ref:`Route.typed_per_filter_config`, etc.\"\n        },\n        \"disable_key\": {\n          \"type\": \"string\",\n          \"description\": \"The key to be set in runtime to disable this rate limit configuration. .. note::   This is not supported if the rate limit action is configured in the ``typed_per_filter_config`` like   :ref:`VirtualHost.typed_per_filter_config` or   :ref:`Route.typed_per_filter_config`, etc.\"\n        },\n        \"actions\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of actions that are to be applied for this rate limit configuration. Order matters as the actions are processed sequentially and the descriptor is composed by appending descriptor entries in that sequence. If an action cannot append a descriptor entry, no descriptor is generated for the configuration. See :ref:`composing actions ` for additional documentation.\"\n        },\n        \"limit\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Override\",\n          \"additionalProperties\": false,\n          \"description\": \"An optional limit override to be appended to the descriptor produced by this rate limit configuration. If the override value is invalid or cannot be resolved from metadata, no override is provided. See :ref:`rate limit override ` for more information. .. note::   For the global HTTP :ref:`rate limit filter   `, this is supported both at the route/virtual host   level and when the rate limit configuration is supplied via the filter's   ``rate_limits`` field or the ``typed_per_filter_config``   (:ref:`RateLimitPerRoute `).   This is not supported by the :ref:`local rate limit filter   `.\"\n        },\n        \"hits_addend\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.HitsAddend\",\n          \"additionalProperties\": false,\n          \"description\": \"An optional hits addend to be appended to the descriptor produced by this rate limit configuration. .. note::   This is only supported if the rate limit action is configured in the ``typed_per_filter_config`` like   :ref:`VirtualHost.typed_per_filter_config` or   :ref:`Route.typed_per_filter_config`, etc.\"\n        },\n        \"apply_on_stream_done\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the rate limit request will be applied when the stream completes. The default value is false. This is useful when the rate limit budget needs to reflect the response context that is not available on the request path. For example, let's say the upstream service calculates the usage statistics and returns them in the response body and we want to utilize these numbers to apply the rate limit action for the subsequent requests. Combined with another filter that can set the desired addend based on the response (e.g. Lua filter), this can be used to subtract the usage statistics from the rate limit budget. A rate limit applied on the stream completion is \\\"fire-and-forget\\\" by nature, and rate limit is not enforced by this config. In other words, the current request won't be blocked when this is true, but the budget will be updated for the subsequent requests based on the action with this field set to true. Users should ensure that the rate limit is enforced by the actions applied on the request path, i.e. the ones with this field set to false. Currently, this is only supported by the HTTP global rate filter.\"\n        },\n        \"x_ratelimit_option\": {\n          \"enum\": [\n            \"UNSPECIFIED\",\n            0,\n            \"OFF\",\n            1,\n            \"DRAFT_VERSION_03\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"X Rate Limit Option\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Rate Limit\",\n      \"description\": \"Global rate limiting :ref:`architecture overview `. Also applies to Local rate limiting :ref:`using descriptors `. [#next-free-field: 8]\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action\": {\n      \"properties\": {\n        \"source_cluster\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.SourceCluster\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on source cluster.\"\n        },\n        \"destination_cluster\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.DestinationCluster\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on destination cluster.\"\n        },\n        \"request_headers\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.RequestHeaders\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on request headers.\"\n        },\n        \"query_parameters\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.QueryParameters\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on query parameters.\"\n        },\n        \"remote_address\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.RemoteAddress\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on remote address.\"\n        },\n        \"generic_key\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.GenericKey\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on a generic key.\"\n        },\n        \"header_value_match\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.HeaderValueMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on the existence of request headers.\"\n        },\n        \"dynamic_metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.DynamicMetaData\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on dynamic metadata. .. attention::   This field has been deprecated in favor of the :ref:`metadata ` field\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.MetaData\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on metadata.\"\n        },\n        \"extension\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit descriptor extension. See the rate limit descriptor extensions documentation. :ref:`HTTP matching input functions ` are permitted as descriptor extensions. The input functions are only looked up if there is no rate limit descriptor extension matching the type URL. [#extension-category: envoy.rate_limit_descriptors]\"\n        },\n        \"masked_remote_address\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.MaskedRemoteAddress\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on masked remote address.\"\n        },\n        \"query_parameter_value_match\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.QueryParameterValueMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on the existence of query parameters.\"\n        },\n        \"remote_address_match\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Action.RemoteAddressMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"Rate limit on remote address match.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Action\",\n      \"description\": \"[#next-free-field: 14]\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.DestinationCluster\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Destination Cluster\",\n      \"description\": \"The following descriptor entry is appended to the descriptor: .. code-block:: cpp   (\\\"destination_cluster\\\", \\\"\\\") Once a request matches against a route table rule, a routed cluster is determined by one of the following :ref:`route table configuration ` settings: * :ref:`cluster ` indicates the upstream cluster   to route to. * :ref:`weighted_clusters `   chooses a cluster randomly from a set of clusters with attributed weight. * :ref:`cluster_header ` indicates which   header in the request contains the target cluster.\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.DynamicMetaData\": {\n      \"properties\": {\n        \"descriptor_key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The key to use in the descriptor entry.\"\n        },\n        \"metadata_key\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKey\",\n          \"additionalProperties\": false,\n          \"description\": \"Metadata struct that defines the key and path to retrieve the string value. A match will only happen if the value in the dynamic metadata is of type string.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"An optional value to use if ``metadata_key`` is empty. If not set and no value is present under the metadata_key then no descriptor is generated.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Dynamic Meta Data\",\n      \"description\": \"The following descriptor entry is appended when the :ref:`dynamic metadata ` contains a key value: .. code-block:: cpp   (\\\"\\\", \\\"\\\") .. attention::   This action has been deprecated in favor of the :ref:`metadata ` action\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.GenericKey\": {\n      \"properties\": {\n        \"descriptor_value\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Descriptor value of entry. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. .. note::   Formatter parsing is controlled by the runtime feature flag   ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value``   (disabled by default).   When enabled: The format string can contain multiple valid substitution   fields. If multiple substitution fields are present, their results will be concatenated   to form the final descriptor value. If it contains no substitution fields, the value   will be used as is. If the final concatenated result is empty and ``default_value`` is set,   the ``default_value`` will be used. If ``default_value`` is not set and the result is   empty, this descriptor will be skipped and not included in the rate limit call.   When disabled (default): The descriptor_value is used as a literal string without any formatter   parsing or substitution. For example, ``static_value`` will be used as is since there are no substitution fields. ``%REQ(:method)%`` will be replaced with the HTTP method, and ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"An optional value to use if the final concatenated ``descriptor_value`` result is empty. Only applicable when formatter parsing is enabled by the runtime feature flag ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` (disabled by default).\"\n        },\n        \"descriptor_key\": {\n          \"type\": \"string\",\n          \"description\": \"An optional key to use in the descriptor entry. If not set it defaults to 'generic_key' as the descriptor key.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Generic Key\",\n      \"description\": \"The following descriptor entry is appended to the descriptor: .. code-block:: cpp   (\\\"generic_key\\\", \\\"\\\")\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.HeaderValueMatch\": {\n      \"properties\": {\n        \"descriptor_value\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Descriptor value of entry. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. .. note::   Formatter parsing is controlled by the runtime feature flag   ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value``   (disabled by default).   When enabled: The format string can contain multiple valid substitution   fields. If multiple substitution fields are present, their results will be concatenated   to form the final descriptor value. If it contains no substitution fields, the value   will be used as is. All substitution fields will be evaluated and their results   concatenated. If the final concatenated result is empty and ``default_value`` is set,   the ``default_value`` will be used. If ``default_value`` is not set and the result is   empty, this descriptor will be skipped and not included in the rate limit call.   When disabled (default): The descriptor_value is used as a literal string without any formatter   parsing or substitution. For example, ``static_value`` will be used as is since there are no substitution fields. ``%REQ(:method)%`` will be replaced with the HTTP method, and ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"An optional value to use if the final concatenated ``descriptor_value`` result is empty. Only applicable when formatter parsing is enabled by the runtime feature flag ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` (disabled by default).\"\n        },\n        \"descriptor_key\": {\n          \"type\": \"string\",\n          \"description\": \"The key to use in the descriptor entry. Defaults to ``header_match``.\"\n        },\n        \"expect_match\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, the action will append a descriptor entry when the request matches the headers. If set to false, the action will append a descriptor entry when the request does not match the headers. The default value is true.\"\n        },\n        \"headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of headers that the rate limit action should match on. The action will check the request's headers against all the specified headers in the config. A match will happen if all the headers in the config are present in the request with the same values (or based on presence if the value field is not in the config).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Value Match\",\n      \"description\": \"The following descriptor entry is appended to the descriptor: .. code-block:: cpp   (\\\"header_match\\\", \\\"\\\") [#next-free-field: 6]\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.MaskedRemoteAddress\": {\n      \"properties\": {\n        \"v4_prefix_mask_len\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Length of prefix mask len for IPv4 (e.g. 0, 32). Defaults to 32 when unset. For example, trusted address from x-forwarded-for is ``192.168.1.1``, the descriptor entry is (\\\"masked_remote_address\\\", \\\"192.168.1.1/32\\\"); if mask len is 24, the descriptor entry is (\\\"masked_remote_address\\\", \\\"192.168.1.0/24\\\").\"\n        },\n        \"v6_prefix_mask_len\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Length of prefix mask len for IPv6 (e.g. 0, 128). Defaults to 128 when unset. For example, trusted address from x-forwarded-for is ``2001:abcd:ef01:2345:6789:abcd:ef01:234``, the descriptor entry is (\\\"masked_remote_address\\\", \\\"2001:abcd:ef01:2345:6789:abcd:ef01:234/128\\\"); if mask len is 64, the descriptor entry is (\\\"masked_remote_address\\\", \\\"2001:abcd:ef01:2345::/64\\\").\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Masked Remote Address\",\n      \"description\": \"The following descriptor entry is appended to the descriptor and is populated using the masked address from :ref:`x-forwarded-for `: .. code-block:: cpp   (\\\"masked_remote_address\\\", \\\"\\\")\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.MetaData\": {\n      \"properties\": {\n        \"descriptor_key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The key to use in the descriptor entry.\"\n        },\n        \"metadata_key\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKey\",\n          \"additionalProperties\": false,\n          \"description\": \"Metadata struct that defines the key and path to retrieve the string value. A match will only happen if the value in the metadata is of type string.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"An optional value to use if ``metadata_key`` is empty. If not set and no value is present under the metadata_key then ``skip_if_absent`` is followed to skip calling the rate limiting service or skip the descriptor.\"\n        },\n        \"source\": {\n          \"enum\": [\n            \"DYNAMIC\",\n            0,\n            \"ROUTE_ENTRY\",\n            1,\n            \"CLUSTER_ENTRY\",\n            2,\n            \"CLUSTER_LOCALITY_ENTRY\",\n            3\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Source\"\n        },\n        \"skip_if_absent\": {\n          \"type\": \"boolean\",\n          \"description\": \"Controls the behavior when the specified ``metadata_key`` is empty and ``default_value`` is not set. If set to ``false`` (default): * Envoy does **NOT** call the rate limiting service for this descriptor. * Useful if the metadata is optional and you prefer to skip rate limiting when it's absent. If set to ``true``: * Envoy calls the rate limiting service but omits this descriptor if the ``metadata_key`` is empty and   ``default_value`` is missing. * Useful if you want Envoy to enforce rate limiting even when the metadata is not present.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Meta Data\",\n      \"description\": \"The following descriptor entry is appended when the metadata contains a key value: .. code-block:: cpp   (\\\"\\\", \\\"\\\") [#next-free-field: 6]\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.QueryParameterValueMatch\": {\n      \"properties\": {\n        \"descriptor_value\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Descriptor value of entry. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. .. note::   Formatter parsing is controlled by the runtime feature flag   ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value``   (disabled by default).   When enabled: The format string can contain multiple valid substitution   fields. If multiple substitution fields are present, their results will be concatenated   to form the final descriptor value. If it contains no substitution fields, the value   will be used as is. All substitution fields will be evaluated and their results   concatenated. If the final concatenated result is empty and ``default_value`` is set,   the ``default_value`` will be used. If ``default_value`` is not set and the result is   empty, this descriptor will be skipped and not included in the rate limit call.   When disabled (default): The descriptor_value is used as a literal string without any formatter   parsing or substitution. For example, ``static_value`` will be used as is since there are no substitution fields. ``%REQ(:method)%`` will be replaced with the HTTP method, and ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"An optional value to use if the final concatenated ``descriptor_value`` result is empty. Only applicable when formatter parsing is enabled by the runtime feature flag ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` (disabled by default).\"\n        },\n        \"descriptor_key\": {\n          \"type\": \"string\",\n          \"description\": \"The key to use in the descriptor entry. Defaults to ``query_match``.\"\n        },\n        \"expect_match\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, the action will append a descriptor entry when the request matches the headers. If set to false, the action will append a descriptor entry when the request does not match the headers. The default value is true.\"\n        },\n        \"query_parameters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.QueryParameterMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of query parameters that the rate limit action should match on. The action will check the request's query parameters against all the specified query parameters in the config. A match will happen if all the query parameters in the config are present in the request with the same values (or based on presence if the value field is not in the config).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Query Parameter Value Match\",\n      \"description\": \"The following descriptor entry is appended to the descriptor: .. code-block:: cpp   (\\\"query_match\\\", \\\"\\\") [#next-free-field: 6]\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.QueryParameters\": {\n      \"properties\": {\n        \"query_parameter_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the query parameter to use for rate limiting. Value of this query parameter is used to populate the value of the descriptor entry for the descriptor_key.\"\n        },\n        \"descriptor_key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The key to use when creating the rate limit descriptor entry. This descriptor key will be used to identify the rate limit rule in the rate limiting service.\"\n        },\n        \"skip_if_absent\": {\n          \"type\": \"boolean\",\n          \"description\": \"Controls the behavior when the specified query parameter is not present in the request. If set to ``false`` (default): * Envoy does **NOT** call the rate limiting service for this descriptor. * Useful if the query parameter is optional and you prefer to skip rate limiting when it's absent. If set to ``true``: * Envoy calls the rate limiting service but omits this descriptor if the query parameter is missing. * Useful if you want Envoy to enforce rate limiting even when the query parameter is not present.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Query Parameters\",\n      \"description\": \"The following descriptor entry is appended when a query parameter contains a key that matches the ``query_parameter_name``: .. code-block:: cpp   (\\\"\\\", \\\"\\\")\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.RemoteAddress\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Remote Address\",\n      \"description\": \"The following descriptor entry is appended to the descriptor and is populated using the trusted address from :ref:`x-forwarded-for `: .. code-block:: cpp   (\\\"remote_address\\\", \\\"\\\")\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.RemoteAddressMatch\": {\n      \"properties\": {\n        \"descriptor_value\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Descriptor value of entry. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. .. note::   The format string can contain multiple valid substitution fields. If multiple   substitution fields are present, their results will be concatenated to form the   final descriptor value. If it contains no substitution fields, the value will be   used as is. All substitution fields will be evaluated and their results concatenated.   If the final concatenated result is empty and ``default_value`` is set, the   ``default_value`` will be used. If ``default_value`` is not set and the result is   empty, this descriptor will be skipped and not included in the rate limit call. For example, ``static_value`` will be used as is since there are no substitution fields. ``%REQ(:method)%`` will be replaced with the HTTP method, and ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers.\"\n        },\n        \"descriptor_key\": {\n          \"type\": \"string\",\n          \"description\": \"The key to use in the descriptor entry. Defaults to ``remote_address_match``.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"An optional value to use if the final concatenated ``descriptor_value`` result is empty.\"\n        },\n        \"address_matcher\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.AddressMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies an address matcher that controls whether the rate limit action is applied. The matcher checks the remote address (trusted address from :ref:`x-forwarded-for `) against the specified CIDR ranges. The rate limit action will be applied if the remote address matches any of the CIDR ranges (or does not match any if ``invert_match`` is set to true in the address matcher).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Remote Address Match\",\n      \"description\": \"The following descriptor entry is appended to the descriptor: .. code-block:: cpp   (\\\"remote_address_match\\\", \\\"\\\")\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.RequestHeaders\": {\n      \"properties\": {\n        \"header_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The header name to be queried from the request headers. The header\u2019s value is used to populate the value of the descriptor entry for the descriptor_key.\"\n        },\n        \"descriptor_key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The key to use in the descriptor entry.\"\n        },\n        \"skip_if_absent\": {\n          \"type\": \"boolean\",\n          \"description\": \"Controls the behavior when the specified header is not present in the request. If set to ``false`` (default): * Envoy does **NOT** call the rate limiting service for this descriptor. * Useful if the header is optional and you prefer to skip rate limiting when it's absent. If set to ``true``: * Envoy calls the rate limiting service but omits this descriptor if the header is missing. * Useful if you want Envoy to enforce rate limiting even when the header is not present.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Request Headers\",\n      \"description\": \"The following descriptor entry is appended when a header contains a key that matches the ``header_name``: .. code-block:: cpp   (\\\"\\\", \\\"\\\")\"\n    },\n    \"envoy.config.route.v3.RateLimit.Action.SourceCluster\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Source Cluster\",\n      \"description\": \"The following descriptor entry is appended to the descriptor: .. code-block:: cpp   (\\\"source_cluster\\\", \\\"\\\")  is derived from the :option:`--service-cluster` option.\"\n    },\n    \"envoy.config.route.v3.RateLimit.HitsAddend\": {\n      \"properties\": {\n        \"number\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"Fixed number of hits to add to the rate limit descriptor. One of the ``number`` or ``format`` fields should be set but not both.\"\n        },\n        \"format\": {\n          \"type\": \"string\",\n          \"description\": \"Substitution format string to extract the number of hits to add to the rate limit descriptor. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here. .. note::   The format string must contains only single valid substitution field. If the format string   not meets the requirement, the configuration will be rejected.   The substitution field should generates a non-negative number or string representation of   a non-negative number. The value of the non-negative number should be less than or equal   to 1000000000 like the ``number`` field. If the output of the substitution field not meet   the requirement, this will be treated as an error and the current descriptor will be ignored. For example, the ``%BYTES_RECEIVED%`` format string will be replaced with the number of bytes received in the request. One of the ``number`` or ``format`` fields should be set but not both.\"\n        },\n        \"is_negative_hits\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the hits addend value will be treated as negative, effectively adding to the rate limit budget instead of consuming from it. This can be used to refill previously consumed rate limit tokens.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Hits Addend\"\n    },\n    \"envoy.config.route.v3.RateLimit.Override\": {\n      \"properties\": {\n        \"dynamic_metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Override.DynamicMetadata\",\n          \"additionalProperties\": false,\n          \"description\": \"Limit override from dynamic metadata.\"\n        },\n        \"rate_limit\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit.Override.RateLimitOverride\",\n          \"additionalProperties\": false,\n          \"description\": \"Static limit override.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Override\"\n    },\n    \"envoy.config.route.v3.RateLimit.Override.DynamicMetadata\": {\n      \"properties\": {\n        \"metadata_key\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKey\",\n          \"additionalProperties\": false,\n          \"description\": \"Metadata struct that defines the key and path to retrieve the struct value. The value must be a struct containing an integer \\\"requests_per_unit\\\" property and a \\\"unit\\\" property with a value parseable to :ref:`RateLimitUnit enum `\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Dynamic Metadata\",\n      \"description\": \"Fetches the override from the dynamic metadata.\"\n    },\n    \"envoy.config.route.v3.RateLimit.Override.RateLimitOverride\": {\n      \"properties\": {\n        \"requests_per_unit\": {\n          \"type\": \"integer\",\n          \"description\": \"The number of requests per unit of time.\"\n        },\n        \"unit\": {\n          \"enum\": [\n            \"UNKNOWN\",\n            0,\n            \"SECOND\",\n            1,\n            \"MINUTE\",\n            2,\n            \"HOUR\",\n            3,\n            \"DAY\",\n            4,\n            \"MONTH\",\n            5,\n            \"YEAR\",\n            6\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Ratelimit Time Unit]\",\n          \"description\": \"[#protodoc-title: Ratelimit Time Unit]  Identifies the unit of of time for rate limit.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Rate Limit Override\",\n      \"description\": \"Rate limit to apply to this descriptor.\"\n    },\n    \"envoy.config.route.v3.RedirectAction\": {\n      \"properties\": {\n        \"https_redirect\": {\n          \"type\": \"boolean\",\n          \"description\": \"The scheme portion of the URL will be swapped with \\\"https\\\".\"\n        },\n        \"scheme_redirect\": {\n          \"type\": \"string\",\n          \"description\": \"The scheme portion of the URL will be swapped with this value.\"\n        },\n        \"host_redirect\": {\n          \"type\": \"string\",\n          \"description\": \"The host portion of the URL will be swapped with this value.\"\n        },\n        \"port_redirect\": {\n          \"type\": \"integer\",\n          \"description\": \"The port value of the URL will be swapped with this value.\"\n        },\n        \"path_redirect\": {\n          \"type\": \"string\",\n          \"description\": \"The path portion of the URL will be swapped with this value. Please note that query string in path_redirect will override the request's query string and will not be stripped. For example, let's say we have the following routes: - match: { path: \\\"/old-path-1\\\" }   redirect: { path_redirect: \\\"/new-path-1\\\" } - match: { path: \\\"/old-path-2\\\" }   redirect: { path_redirect: \\\"/new-path-2\\\", strip-query: \\\"true\\\" } - match: { path: \\\"/old-path-3\\\" }   redirect: { path_redirect: \\\"/new-path-3?foo=1\\\", strip_query: \\\"true\\\" } 1. if request uri is \\\"/old-path-1?bar=1\\\", users will be redirected to \\\"/new-path-1?bar=1\\\" 2. if request uri is \\\"/old-path-2?bar=1\\\", users will be redirected to \\\"/new-path-2\\\" 3. if request uri is \\\"/old-path-3?bar=1\\\", users will be redirected to \\\"/new-path-3?foo=1\\\"\"\n        },\n        \"prefix_rewrite\": {\n          \"type\": \"string\",\n          \"description\": \"Indicates that during redirection, the matched prefix (or path) should be swapped with this value. This option allows redirect URLs be dynamically created based on the request. .. attention::   Pay attention to the use of trailing slashes as mentioned in   :ref:`RouteAction's prefix_rewrite `.\"\n        },\n        \"regex_rewrite\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatchAndSubstitute\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that during redirect, portions of the path that match the pattern should be rewritten, even allowing the substitution of capture groups from the pattern into the new path as specified by the rewrite substitution string. This is useful to allow application paths to be rewritten in a way that is aware of segments with variable content like identifiers. Examples using Google's `RE2 `_ engine: * The path pattern ``^/service/([^/]+)(/.*)$`` paired with a substitution   string of ``\\\\2/instance/\\\\1`` would transform ``/service/foo/v1/api``   into ``/v1/api/instance/foo``. * The pattern ``one`` paired with a substitution string of ``two`` would   transform ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/two/zzz``. * The pattern ``^(.*?)one(.*)$`` paired with a substitution string of   ``\\\\1two\\\\2`` would replace only the first occurrence of ``one``,   transforming path ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/one/zzz``. * The pattern ``(?i)/xxx/`` paired with a substitution string of ``/yyy/``   would do a case-insensitive match and transform path ``/aaa/XxX/bbb`` to   ``/aaa/yyy/bbb``.\"\n        },\n        \"path_rewrite\": {\n          \"type\": \"string\",\n          \"description\": \"The path portion of the URL will be set to this value and supports :ref:`substitution format specifiers ` and CEL expressions. For example, with the following config: .. code-block:: yaml   path_rewrite: \\\"/new/%REQ(x-version)%\\\" Would redirect to ``/new/v2`` given a request header ``x-version: v2``. If the substitution produces an empty string the path redirect is ignored and the original path is preserved.\"\n        },\n        \"response_code\": {\n          \"enum\": [\n            \"MOVED_PERMANENTLY\",\n            0,\n            \"FOUND\",\n            1,\n            \"SEE_OTHER\",\n            2,\n            \"TEMPORARY_REDIRECT\",\n            3,\n            \"PERMANENT_REDIRECT\",\n            4\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Redirect Response Code\"\n        },\n        \"strip_query\": {\n          \"type\": \"boolean\",\n          \"description\": \"Indicates that during redirection, the query portion of the URL will be removed. Default value is false.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Redirect Action\",\n      \"description\": \"[#next-free-field: 11]\"\n    },\n    \"envoy.config.route.v3.RetryPolicy\": {\n      \"properties\": {\n        \"retry_on\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the conditions under which retry takes place. These are the same conditions documented for :ref:`config_http_filters_router_x-envoy-retry-on` and :ref:`config_http_filters_router_x-envoy-retry-grpc-on`.\"\n        },\n        \"num_retries\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Specifies the allowed number of retries. This parameter is optional and defaults to 1. These are the same conditions documented for :ref:`config_http_filters_router_x-envoy-max-retries`.\"\n        },\n        \"per_try_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies a non-zero upstream timeout per retry attempt (including the initial attempt). This parameter is optional. The same conditions documented for :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms` apply. .. note::   If left unspecified, Envoy will use the global   :ref:`route timeout ` for the request.   Consequently, when using a :ref:`5xx ` based   retry policy, a request that times out will not be retried as the total timeout budget   would have been exhausted.\",\n          \"format\": \"regex\"\n        },\n        \"per_try_idle_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies an upstream idle timeout per retry attempt (including the initial attempt). This parameter is optional and if absent there is no per-try idle timeout. The semantics of the per- try idle timeout are similar to the :ref:`route idle timeout ` and :ref:`stream idle timeout ` both enforced by the HTTP connection manager. The difference is that this idle timeout is enforced by the router for each individual attempt and thus after all previous filters have run, as opposed to *before* all previous filters run for the other idle timeouts. This timeout is useful in cases in which total request timeout is bounded by a number of retries and a :ref:`per_try_timeout `, but there is a desire to ensure each try is making incremental progress. Note also that similar to :ref:`per_try_timeout `, this idle timeout does not start until after both the entire request has been received by the router *and* a connection pool connection has been obtained. Unlike :ref:`per_try_timeout `, the idle timer continues once the response starts streaming back to the downstream client. This ensures that response data continues to make progress without using one of the HTTP connection manager idle timeouts.\",\n          \"format\": \"regex\"\n        },\n        \"retry_priority\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy.RetryPriority\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies an implementation of a RetryPriority which is used to determine the distribution of load across priorities used for retries. Refer to :ref:`retry plugin configuration ` for more details.\"\n        },\n        \"retry_host_predicate\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy.RetryHostPredicate\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a collection of RetryHostPredicates that will be consulted when selecting a host for retries. If any of the predicates reject the host, host selection will be reattempted. Refer to :ref:`retry plugin configuration ` for more details.\"\n        },\n        \"retry_options_predicates\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Retry options predicates that will be applied prior to retrying a request. These predicates allow customizing request behavior between retries. [#comment: add [#extension-category: envoy.retry_options_predicates] when there are built-in extensions]\"\n        },\n        \"host_selection_retry_max_attempts\": {\n          \"type\": \"string\",\n          \"description\": \"The maximum number of times host selection will be reattempted before giving up, at which point the host that was last selected will be routed to. If unspecified, this will default to retrying once.\"\n        },\n        \"retriable_status_codes\": {\n          \"items\": {\n            \"type\": \"integer\"\n          },\n          \"type\": \"array\",\n          \"description\": \"HTTP status codes that should trigger a retry in addition to those specified by retry_on.\"\n        },\n        \"retry_back_off\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy.RetryBackOff\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies parameters that control exponential retry back off. This parameter is optional, in which case the default base interval is 25 milliseconds or, if set, the current value of the ``upstream.base_retry_backoff_ms`` runtime parameter. The default maximum interval is 10 times the base interval. The documentation for :ref:`config_http_filters_router_x-envoy-max-retries` describes Envoy's back-off algorithm.\"\n        },\n        \"rate_limited_retry_back_off\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy.RateLimitedRetryBackOff\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies parameters that control a retry back-off strategy that is used when the request is rate limited by the upstream server. The server may return a response header like ``Retry-After`` or ``X-RateLimit-Reset`` to provide feedback to the client on how long to wait before retrying. If configured, this back-off strategy will be used instead of the default exponential back off strategy (configured using ``retry_back_off``) whenever a response includes the matching headers.\"\n        },\n        \"retriable_headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"HTTP response headers that trigger a retry if present in the response. A retry will be triggered if any of the header matches match the upstream response headers. The field is only consulted if 'retriable-headers' retry policy is active.\"\n        },\n        \"retriable_request_headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"HTTP headers which must be present in the request for retries to be attempted.\"\n        },\n        \"refresh_cluster_on_retry\": {\n          \"type\": \"boolean\",\n          \"description\": \"By default, the target upstream cluster of a retry request is the same as the original request, and Envoy will not try to refresh it when retrying. If this field is set to true, Envoy will try to refresh the target upstream cluster when retrying a request. This is useful when users want to try different upstream cluster for each retry attempt. .. note::   This currently works when the route cluster specifier support the dynamic refresh,   e.g. :ref:`matcher cluster specifier   `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Policy\",\n      \"description\": \"HTTP retry :ref:`architecture overview `. [#next-free-field: 15]\"\n    },\n    \"envoy.config.route.v3.RetryPolicy.RateLimitedRetryBackOff\": {\n      \"properties\": {\n        \"reset_headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy.ResetHeader\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies the reset headers (like ``Retry-After`` or ``X-RateLimit-Reset``) to match against the response. Headers are tried in order, and matched case insensitive. The first header to be parsed successfully is used. If no headers match the default exponential back-off is used instead.\"\n        },\n        \"max_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the maximum back off interval that Envoy will allow. If a reset header contains an interval longer than this then it will be discarded and the next header will be tried. Defaults to 300 seconds.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Rate Limited Retry Back Off\",\n      \"description\": \"A retry back-off strategy that applies when the upstream server rate limits the request. Given this configuration: .. code-block:: yaml   rate_limited_retry_back_off:     reset_headers:     - name: Retry-After       format: SECONDS     - name: X-RateLimit-Reset       format: UNIX_TIMESTAMP     max_interval: \\\"300s\\\" The following algorithm will apply:  1. If the response contains the header ``Retry-After`` its value must be on     the form ``120`` (an integer that represents the number of seconds to     wait before retrying). If so, this value is used as the back-off interval.  2. Otherwise, if the response contains the header ``X-RateLimit-Reset`` its     value must be on the form ``1595320702`` (an integer that represents the     point in time at which to retry, as a Unix timestamp in seconds). If so,     the current time is subtracted from this value and the result is used as     the back-off interval.  3. Otherwise, Envoy will use the default     :ref:`exponential back-off `     strategy. No matter which format is used, if the resulting back-off interval exceeds ``max_interval`` it is discarded and the next header in ``reset_headers`` is tried. If a request timeout is configured for the route it will further limit how long the request will be allowed to run. To prevent many clients retrying at the same point in time jitter is added to the back-off interval, so the resulting interval is decided by taking: ``random(interval, interval * 1.5)``. .. attention::   Configuring ``rate_limited_retry_back_off`` will not by itself cause a request   to be retried. You will still need to configure the right retry policy to match   the responses from the upstream server.\"\n    },\n    \"envoy.config.route.v3.RetryPolicy.ResetHeader\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the reset header. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"format\": {\n          \"enum\": [\n            \"SECONDS\",\n            0,\n            \"UNIX_TIMESTAMP\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Reset Header Format\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Reset Header\"\n    },\n    \"envoy.config.route.v3.RetryPolicy.RetryBackOff\": {\n      \"properties\": {\n        \"base_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the base interval between retries. This parameter is required and must be greater than zero. Values less than 1 ms are rounded up to 1 ms. See :ref:`config_http_filters_router_x-envoy-max-retries` for a discussion of Envoy's back-off algorithm.\",\n          \"format\": \"regex\"\n        },\n        \"max_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the maximum interval between retries. This parameter is optional, but must be greater than or equal to the ``base_interval`` if set. The default is 10 times the ``base_interval``. See :ref:`config_http_filters_router_x-envoy-max-retries` for a discussion of Envoy's back-off algorithm.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Back Off\"\n    },\n    \"envoy.config.route.v3.RetryPolicy.RetryHostPredicate\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Host Predicate\"\n    },\n    \"envoy.config.route.v3.RetryPolicy.RetryPriority\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Retry Priority\"\n    },\n    \"envoy.config.route.v3.Route\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"Name for the route.\"\n        },\n        \"match\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"Route matching parameters.\"\n        },\n        \"route\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction\",\n          \"additionalProperties\": false,\n          \"description\": \"Route request to some upstream cluster.\"\n        },\n        \"redirect\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RedirectAction\",\n          \"additionalProperties\": false,\n          \"description\": \"Return a redirect.\"\n        },\n        \"direct_response\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.DirectResponseAction\",\n          \"additionalProperties\": false,\n          \"description\": \"Return an arbitrary HTTP response directly, without proxying.\"\n        },\n        \"filter_action\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.FilterAction\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] A filter-defined action (e.g., it could dynamically generate the RouteAction). [#comment: TODO(samflattery): Remove cleanup in route_fuzz_test.cc when implemented]\"\n        },\n        \"non_forwarding_action\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.NonForwardingAction\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] An action used when the route will generate a response directly, without forwarding to an upstream host. This will be used in non-proxy xDS clients like the gRPC server. It could also be used in the future in Envoy for a filter that directly generates responses for requests.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"The Metadata field can be used to provide additional information about the route. It can be used for configuration, stats, and logging. The metadata should go under the filter namespace that will need it. For instance, if the metadata is intended for the Router filter, the filter name should be specified as ``envoy.filters.http.router``.\"\n        },\n        \"decorator\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.Decorator\",\n          \"additionalProperties\": false,\n          \"description\": \"Decorator for the matched route.\"\n        },\n        \"typed_per_filter_config\": {\n          \"additionalProperties\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"type\": \"object\",\n          \"description\": \"This field can be used to provide route specific per filter config. The key should match the :ref:`filter config name `. See :ref:`HTTP filter route-specific config ` for details. [#comment: An entry's value may be wrapped in a :ref:`FilterConfig` message to specify additional options.]\"\n        },\n        \"request_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of headers that will be added to requests matching this route. Headers specified at this level are applied before headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` and :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"request_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each request matching this route.\"\n        },\n        \"response_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of headers that will be added to responses to requests matching this route. Headers specified at this level are applied before headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` and :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"response_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each response to requests matching this route.\"\n        },\n        \"tracing\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.Tracing\",\n          \"additionalProperties\": false,\n          \"description\": \"Presence of the object defines whether the connection manager's tracing configuration is overridden by this route specific instance.\"\n        },\n        \"per_request_buffer_limit_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum bytes which will be buffered for retries and shadowing. If set, the bytes actually buffered will be the minimum value of this and the listener per_connection_buffer_limit_bytes. .. attention::   This field has been deprecated. Please use :ref:`request_body_buffer_limit   ` instead.   Only one of ``per_request_buffer_limit_bytes`` and ``request_body_buffer_limit`` may be set.\"\n        },\n        \"stat_prefix\": {\n          \"type\": \"string\",\n          \"description\": \"The human readable prefix to use when emitting statistics for this endpoint. The statistics are rooted at vhost..route.. This should be set for highly critical endpoints that one wishes to get \u201cper-route\u201d statistics on. If not set, endpoint statistics are not generated. The emitted statistics are the same as those documented for :ref:`virtual clusters `. .. warning::    We do not recommend setting up a stat prefix for    every application endpoint. This is both not easily maintainable and    statistics use a non-trivial amount of memory (approximately 1KiB per route).\"\n        },\n        \"request_body_buffer_limit\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"The maximum bytes which will be buffered for request bodies to support large request body buffering beyond the ``per_connection_buffer_limit_bytes``. This limit is specifically for the request body buffering and allows buffering larger payloads while maintaining flow control. Buffer limit precedence (from highest to lowest priority): 1. If ``request_body_buffer_limit`` is set: use ``request_body_buffer_limit`` 2. If :ref:`per_request_buffer_limit_bytes `    is set but ``request_body_buffer_limit`` is not: use ``min(per_request_buffer_limit_bytes, per_connection_buffer_limit_bytes)`` 3. If neither is set: use ``per_connection_buffer_limit_bytes`` For flow control chunk sizes, use ``min(per_connection_buffer_limit_bytes, 16KB)``. Only one of :ref:`per_request_buffer_limit_bytes ` and ``request_body_buffer_limit`` may be set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Route\",\n      \"description\": \"A route is both a specification of how to match a request as well as an indication of what to do next (e.g., redirect, forward, rewrite, etc.). .. attention::   Envoy supports routing on HTTP method via :ref:`header matching   `. [#next-free-field: 21]\"\n    },\n    \"envoy.config.route.v3.RouteAction\": {\n      \"properties\": {\n        \"cluster\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Indicates the upstream cluster to which the request should be routed to.\"\n        },\n        \"cluster_header\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Envoy will determine the cluster to route to by reading the value of the HTTP header named by cluster_header from the request headers. If the header is not found or the referenced cluster does not exist, Envoy will return a 404 response. .. attention::   Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1   ``Host`` header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"weighted_clusters\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.WeightedCluster\",\n          \"additionalProperties\": false,\n          \"description\": \"Multiple upstream clusters can be specified for a given route. The request is routed to one of the upstream clusters based on weights assigned to each cluster. See :ref:`traffic splitting ` for additional documentation.\"\n        },\n        \"cluster_specifier_plugin\": {\n          \"type\": \"string\",\n          \"description\": \"Name of the cluster specifier plugin to use to determine the cluster for requests on this route. The cluster specifier plugin name must be defined in the associated :ref:`cluster specifier plugins ` in the :ref:`name ` field.\"\n        },\n        \"inline_cluster_specifier_plugin\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.ClusterSpecifierPlugin\",\n          \"additionalProperties\": false,\n          \"description\": \"Custom cluster specifier plugin configuration to use to determine the cluster for requests on this route.\"\n        },\n        \"cluster_not_found_response_code\": {\n          \"enum\": [\n            \"SERVICE_UNAVAILABLE\",\n            0,\n            \"NOT_FOUND\",\n            1,\n            \"INTERNAL_SERVER_ERROR\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Cluster Not Found Response Code\"\n        },\n        \"metadata_match\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional endpoint metadata match criteria used by the subset load balancer. Only endpoints in the upstream cluster with metadata matching what's set in this field will be considered for load balancing. If using :ref:`weighted_clusters `, metadata will be merged, with values provided there taking precedence. The filter name should be specified as ``envoy.lb``.\"\n        },\n        \"prefix_rewrite\": {\n          \"type\": \"string\",\n          \"description\": \"Indicates that during forwarding, the matched prefix (or path) should be swapped with this value. This option allows application URLs to be rooted at a different path from those exposed at the reverse proxy layer. The router filter will place the original path before rewrite into the :ref:`x-envoy-original-path ` header. Only one of :ref:`regex_rewrite `, :ref:`path_rewrite_policy `, :ref:`path_rewrite `, or :ref:`prefix_rewrite ` may be specified. .. attention::   Pay careful attention to the use of trailing slashes in the   :ref:`route's match ` prefix value.   Stripping a prefix from a path requires multiple Routes to handle all cases. For example,   rewriting ``/prefix`` to ``/`` and ``/prefix/etc`` to ``/etc`` cannot be done in a single   :ref:`Route `, as shown by the below config entries:   .. code-block:: yaml     - match:         prefix: \\\"/prefix/\\\"       route:         prefix_rewrite: \\\"/\\\"     - match:         prefix: \\\"/prefix\\\"       route:         prefix_rewrite: \\\"/\\\"   Having above entries in the config, requests to ``/prefix`` will be stripped to ``/``, while   requests to ``/prefix/etc`` will be stripped to ``/etc``.\"\n        },\n        \"regex_rewrite\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatchAndSubstitute\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that during forwarding, portions of the path that match the pattern should be rewritten, even allowing the substitution of capture groups from the pattern into the new path as specified by the rewrite substitution string. This is useful to allow application paths to be rewritten in a way that is aware of segments with variable content like identifiers. The router filter will place the original path as it was before the rewrite into the :ref:`x-envoy-original-path ` header. Only one of :ref:`regex_rewrite `, :ref:`path_rewrite_policy `, :ref:`path_rewrite `, or :ref:`prefix_rewrite ` may be specified. Examples using Google's `RE2 `_ engine: * The path pattern ``^/service/([^/]+)(/.*)$`` paired with a substitution   string of ``\\\\2/instance/\\\\1`` would transform ``/service/foo/v1/api``   into ``/v1/api/instance/foo``. * The pattern ``one`` paired with a substitution string of ``two`` would   transform ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/two/zzz``. * The pattern ``^(.*?)one(.*)$`` paired with a substitution string of   ``\\\\1two\\\\2`` would replace only the first occurrence of ``one``,   transforming path ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/one/zzz``. * The pattern ``(?i)/xxx/`` paired with a substitution string of ``/yyy/``   would do a case-insensitive match and transform path ``/aaa/XxX/bbb`` to   ``/aaa/yyy/bbb``.\"\n        },\n        \"path_rewrite_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"[#extension-category: envoy.path.rewrite]\"\n        },\n        \"path_rewrite\": {\n          \"type\": \"string\",\n          \"description\": \"Rewrites the whole path (without query parameters) with the given path value. The router filter will place the original path before rewrite into the :ref:`x-envoy-original-path ` header. Only one of :ref:`regex_rewrite `, :ref:`path_rewrite_policy `, :ref:`path_rewrite `, or :ref:`prefix_rewrite ` may be specified. The :ref:`substitution format specifier ` could be applied here. For example, with the following config:   .. code-block:: yaml     path_rewrite: \\\"/new_path_prefix%REQ(custom-path-header-name)%\\\" Would rewrite the path to ``/new_path_prefix/some_value`` given the header ``custom-path-header-name: some_value``. If the header is not present, the path will be rewritten to ``/new_path_prefix``. If the final output of the path rewrite is empty, then the update will be ignored and the original path will be preserved.\"\n        },\n        \"host_rewrite_literal\": {\n          \"type\": \"string\",\n          \"description\": \"Indicates that during forwarding, the host header will be swapped with this value.\"\n        },\n        \"auto_host_rewrite\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Indicates that during forwarding, the host header will be swapped with the hostname of the upstream host chosen by the cluster manager. This option is applicable only when the destination cluster for a route is of type ``strict_dns`` or ``logical_dns``, or when :ref:`hostname ` field is not empty. Setting this to true with other cluster types has no effect.\"\n        },\n        \"host_rewrite_header\": {\n          \"type\": \"string\",\n          \"description\": \"Indicates that during forwarding, the host header will be swapped with the content of given downstream or :ref:`custom ` header. If header value is empty, host header is left intact. .. attention::   Pay attention to the potential security implications of using this option. Provided header   must come from trusted source. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"host_rewrite_path_regex\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatchAndSubstitute\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that during forwarding, the host header will be swapped with the result of the regex substitution executed on path value with query and fragment removed. This is useful for transitioning variable content between path segment and subdomain. For example with the following config:   .. code-block:: yaml     host_rewrite_path_regex:       pattern:         google_re2: {}         regex: \\\"^/(.+)/.+$\\\"       substitution: \\\\1 Would rewrite the host header to ``envoyproxy.io`` given the path ``/envoyproxy.io/some/path``.\"\n        },\n        \"host_rewrite\": {\n          \"type\": \"string\",\n          \"description\": \"Rewrites the host header with the value of this field. The router filter will place the original host header value before rewriting into the :ref:`x-envoy-original-host ` header. The :ref:`substitution format specifier ` could be applied here. For example, with the following config:   .. code-block:: yaml     host_rewrite: \\\"prefix-%REQ(custom-host-header-name)%\\\" Would rewrite the host header to ``prefix-some_value`` given the header ``custom-host-header-name: some_value``. If the header is not present, the host header will be rewritten to an value of ``prefix-``. If the final output of the host rewrite is empty, then the update will be ignored and the original host header will be preserved.\"\n        },\n        \"append_x_forwarded_host\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set, then a host rewrite action (one of :ref:`host_rewrite_literal `, :ref:`auto_host_rewrite `, :ref:`host_rewrite_header `, or :ref:`host_rewrite_path_regex `) causes the original value of the host header, if any, to be appended to the :ref:`config_http_conn_man_headers_x-forwarded-host` HTTP header if it is different to the last value appended.\"\n        },\n        \"timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the upstream timeout for the route. If not specified, the default is 15s. This spans between the point at which the entire downstream request (i.e. end-of-stream) has been processed and when the upstream response has been completely processed. A value of 0 will disable the route's timeout. .. note::   This timeout includes all retries. See also   :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`,   :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the   :ref:`retry overview `.\",\n          \"format\": \"regex\"\n        },\n        \"idle_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the idle timeout for the route. If not specified, there is no per-route idle timeout, although the connection manager wide :ref:`stream_idle_timeout ` will still apply. A value of 0 will completely disable the route's idle timeout, even if a connection manager stream idle timeout is configured. The idle timeout is distinct to :ref:`timeout `, which provides an upper bound on the upstream response time; :ref:`idle_timeout ` instead bounds the amount of time the request's stream may be idle. After header decoding, the idle timeout will apply on downstream and upstream request events. Each time an encode/decode event for headers or data is processed for the stream, the timer will be reset. If the timeout fires, the stream is terminated with a 408 Request Timeout error code if no upstream response header has been received, otherwise a stream reset occurs. If the :ref:`overload action ` \\\"envoy.overload_actions.reduce_timeouts\\\" is configured, this timeout is scaled according to the value for :ref:`HTTP_DOWNSTREAM_STREAM_IDLE `. This timeout may also be used in place of ``flush_timeout`` in very specific cases. See the documentation for ``flush_timeout`` for more details.\",\n          \"format\": \"regex\"\n        },\n        \"flush_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the codec stream flush timeout for the route. If not specified, the first preference is the global :ref:`stream_flush_timeout `, but only if explicitly configured. If neither the explicit HCM-wide flush timeout nor this route-specific flush timeout is configured, the route's stream idle timeout is reused for this timeout. This is for backwards compatibility since both behaviors were historically controlled by the one timeout. If the route also does not have an idle timeout configured, the global :ref:`stream_idle_timeout `. used, again for backwards compatibility. That timeout defaults to 5 minutes. A value of 0 via any of the above paths will completely disable the timeout for a given route.\",\n          \"format\": \"regex\"\n        },\n        \"early_data_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies how to send request over TLS early data. If absent, allows `safe HTTP requests `_ to be sent on early data. [#extension-category: envoy.route.early_data_policy]\"\n        },\n        \"retry_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that the route has a retry policy. Note that if this is set, it'll take precedence over the virtual host level retry policy entirely (e.g., policies are not merged, the most internal one becomes the enforced policy).\"\n        },\n        \"retry_policy_typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"request_mirror_policies\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.RequestMirrorPolicy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specify a set of route request mirroring policies. It takes precedence over the virtual host and route config mirror policy entirely. That is, policies are not merged, the most specific non-empty one becomes the mirror policies.\"\n        },\n        \"priority\": {\n          \"enum\": [\n            \"DEFAULT\",\n            0,\n            \"HIGH\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"[#protodoc-title: Common types]\",\n          \"description\": \"[#protodoc-title: Common types]  Envoy supports :ref:`upstream priority routing ` both at the route and the virtual cluster level. The current priority implementation uses different connection pool and circuit breaking settings for each priority level. This means that even for HTTP/2 requests, two physical connections will be used to an upstream host. In the future Envoy will likely support true HTTP/2 priority over a single upstream connection.\"\n        },\n        \"rate_limits\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of rate limit configurations that could be applied to the route.\"\n        },\n        \"include_vh_rate_limits\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Specifies if the rate limit filter should include the virtual host rate limits. By default, if the route configured rate limits, the virtual host :ref:`rate_limits ` are not applied to the request. .. attention::   This field is deprecated. Please use :ref:`vh_rate_limits `\"\n        },\n        \"hash_policy\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of hash policies to use for ring hash load balancing. Each hash policy is evaluated individually and the combined result is used to route the request. The method of combination is deterministic such that identical lists of hash policies will produce the same hash. Since a hash policy examines specific parts of a request, it can fail to produce a hash (i.e. if the hashed header is not present). If (and only if) all configured hash policies fail to generate a hash, no hash will be produced for the route. In this case, the behavior is the same as if no hash policies were specified (i.e. the ring hash load balancer will choose a random backend). If a hash policy has the \\\"terminal\\\" attribute set to true, and there is already a hash generated, the hash is returned immediately, ignoring the rest of the hash policy list.\"\n        },\n        \"cors\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.CorsPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that the route has a CORS policy. This field is ignored if related cors policy is found in the :ref:`Route.typed_per_filter_config` or :ref:`WeightedCluster.ClusterWeight.typed_per_filter_config`. .. attention::   This option has been deprecated. Please use   :ref:`Route.typed_per_filter_config` or   :ref:`WeightedCluster.ClusterWeight.typed_per_filter_config`   to configure the CORS HTTP filter.\"\n        },\n        \"max_grpc_timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Deprecated by :ref:`grpc_timeout_header_max ` If present, and the request is a gRPC request, use the `grpc-timeout header `_, or its default value (infinity) instead of :ref:`timeout `, but limit the applied timeout to the maximum value specified here. If configured as 0, the maximum allowed timeout for gRPC requests is infinity. If not configured at all, the ``grpc-timeout`` header is not used and gRPC requests time out like any other requests using :ref:`timeout ` or its default. This can be used to prevent unexpected upstream request timeouts due to potentially long time gaps between gRPC request and response in gRPC streaming mode. .. note::    If a timeout is specified using :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`, it takes    precedence over `grpc-timeout header `_, when    both are present. See also    :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`,    :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the    :ref:`retry overview `.\",\n          \"format\": \"regex\"\n        },\n        \"grpc_timeout_offset\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Deprecated by :ref:`grpc_timeout_header_offset `. If present, Envoy will adjust the timeout provided by the ``grpc-timeout`` header by subtracting the provided duration from the header. This is useful in allowing Envoy to set its global timeout to be less than that of the deadline imposed by the calling client, which makes it more likely that Envoy will handle the timeout instead of having the call canceled by the client. The offset will only be applied if the provided grpc_timeout is greater than the offset. This ensures that the offset will only ever decrease the timeout and never set it to 0 (meaning infinity).\",\n          \"format\": \"regex\"\n        },\n        \"upgrade_configs\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.UpgradeConfig\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        },\n        \"internal_redirect_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.InternalRedirectPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"If present, Envoy will try to follow an upstream redirect response instead of proxying the response back to the downstream. An upstream redirect response is defined by :ref:`redirect_response_codes `.\"\n        },\n        \"internal_redirect_action\": {\n          \"enum\": [\n            \"PASS_THROUGH_INTERNAL_REDIRECT\",\n            0,\n            \"HANDLE_INTERNAL_REDIRECT\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Internal Redirect Action\",\n          \"description\": \"Configures :ref:`internal redirect ` behavior. [#next-major-version: remove this definition - it's defined in the InternalRedirectPolicy message.]\"\n        },\n        \"max_internal_redirects\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"An internal redirect is handled, iff the number of previous internal redirects that a downstream request has encountered is lower than this value, and :ref:`internal_redirect_action ` is set to :ref:`HANDLE_INTERNAL_REDIRECT ` In the case where a downstream request is bounced among multiple routes by internal redirect, the first route that hits this threshold, or has :ref:`internal_redirect_action ` set to :ref:`PASS_THROUGH_INTERNAL_REDIRECT ` will pass the redirect back to downstream. If not specified, at most one redirect will be followed.\"\n        },\n        \"hedge_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.HedgePolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that the route has a hedge policy. Note that if this is set, it'll take precedence over the virtual host level hedge policy entirely (e.g., policies are not merged, the most internal one becomes the enforced policy).\"\n        },\n        \"max_stream_duration\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.MaxStreamDuration\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the maximum stream duration for this route.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Route Action\",\n      \"description\": \"[#next-free-field: 46]\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy\": {\n      \"properties\": {\n        \"header\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy.Header\",\n          \"additionalProperties\": false,\n          \"description\": \"Header hash policy.\"\n        },\n        \"cookie\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy.Cookie\",\n          \"additionalProperties\": false,\n          \"description\": \"Cookie hash policy.\"\n        },\n        \"connection_properties\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy.ConnectionProperties\",\n          \"additionalProperties\": false,\n          \"description\": \"Connection properties hash policy.\"\n        },\n        \"query_parameter\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy.QueryParameter\",\n          \"additionalProperties\": false,\n          \"description\": \"Query parameter hash policy.\"\n        },\n        \"filter_state\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy.FilterState\",\n          \"additionalProperties\": false,\n          \"description\": \"Filter state hash policy.\"\n        },\n        \"terminal\": {\n          \"type\": \"boolean\",\n          \"description\": \"The flag that short-circuits the hash computing. This field provides a 'fallback' style of configuration: \\\"if a terminal policy doesn't work, fallback to rest of the policy list\\\", it saves time when the terminal policy works. If true, and there is already a hash computed, ignore rest of the list of hash polices. For example, if the following hash methods are configured:  ========= ========  specifier terminal  ========= ========  Header A  true  Header B  false  Header C  false  ========= ======== The generateHash process ends if policy \\\"header A\\\" generates a hash, as it's a terminal policy.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Hash Policy\",\n      \"description\": \"Specifies the route's hashing policy if the upstream cluster uses a hashing :ref:`load balancer `. [#next-free-field: 7]\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy.ConnectionProperties\": {\n      \"properties\": {\n        \"source_ip\": {\n          \"type\": \"boolean\",\n          \"description\": \"Hash on source IP address.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Connection Properties\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy.Cookie\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the cookie that will be used to obtain the hash key. If the cookie is not present and ttl below is not set, no hash will be produced.\"\n        },\n        \"ttl\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If specified, a cookie with the TTL will be generated if the cookie is not present. If the TTL is present and zero, the generated cookie will be a session cookie.\",\n          \"format\": \"regex\"\n        },\n        \"path\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the path for the cookie. If no path is specified here, no path will be set for the cookie.\"\n        },\n        \"attributes\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy.CookieAttribute\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Additional attributes for the cookie. They will be used when generating a new cookie.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cookie\",\n      \"description\": \"Envoy supports two types of cookie affinity: 1. Passive. Envoy takes a cookie that's present in the cookies header and    hashes on its value. 2. Generated. Envoy generates and sets a cookie with an expiration (TTL)    on the first request from the client in its response to the client,    based on the endpoint the request gets sent to. The client then    presents this on the next and all subsequent requests. The hash of    this is sufficient to ensure these requests get sent to the same    endpoint. The cookie is generated by hashing the source and    destination ports and addresses so that multiple independent HTTP2    streams on the same connection will independently receive the same    cookie, even if they arrive at the Envoy simultaneously.\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy.CookieAttribute\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the cookie attribute.\"\n        },\n        \"value\": {\n          \"type\": \"string\",\n          \"description\": \"The optional value of the cookie attribute.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cookie Attribute\",\n      \"description\": \"CookieAttribute defines an API for adding additional attributes for a HTTP cookie.\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy.FilterState\": {\n      \"properties\": {\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the Object in the per-request filterState, which is an Envoy::Hashable object. If there is no data associated with the key, or the stored object is not Envoy::Hashable, no hash will be produced.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Filter State\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy.Header\": {\n      \"properties\": {\n        \"header_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the request header that will be used to obtain the hash key. If the request header is not present, no hash will be produced.\"\n        },\n        \"regex_rewrite\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatchAndSubstitute\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, the request header value will be rewritten and used to produce the hash key.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header\"\n    },\n    \"envoy.config.route.v3.RouteAction.HashPolicy.QueryParameter\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the URL query parameter that will be used to obtain the hash key. If the parameter is not present, no hash will be produced. Query parameter names are case-sensitive. If query parameters are repeated, only the first value will be considered.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Query Parameter\"\n    },\n    \"envoy.config.route.v3.RouteAction.MaxStreamDuration\": {\n      \"properties\": {\n        \"max_stream_duration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Specifies the maximum duration allowed for streams on the route. If not specified, the value from the :ref:`max_stream_duration ` field in :ref:`HttpConnectionManager.common_http_protocol_options ` is used. If this field is set explicitly to zero, any HttpConnectionManager max_stream_duration timeout will be disabled for this route.\",\n          \"format\": \"regex\"\n        },\n        \"grpc_timeout_header_max\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If present, and the request contains a `grpc-timeout header `_, use that value as the ``max_stream_duration``, but limit the applied timeout to the maximum value specified here. If set to 0, the ``grpc-timeout`` header is used without modification.\",\n          \"format\": \"regex\"\n        },\n        \"grpc_timeout_header_offset\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"If present, Envoy will adjust the timeout provided by the ``grpc-timeout`` header by subtracting the provided duration from the header. This is useful for allowing Envoy to set its global timeout to be less than that of the deadline imposed by the calling client, which makes it more likely that Envoy will handle the timeout instead of having the call canceled by the client. If, after applying the offset, the resulting timeout is zero or negative, the stream will timeout immediately.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Max Stream Duration\"\n    },\n    \"envoy.config.route.v3.RouteAction.RequestMirrorPolicy\": {\n      \"properties\": {\n        \"cluster\": {\n          \"type\": \"string\",\n          \"description\": \"Only one of ``cluster`` and ``cluster_header`` can be specified. [#next-major-version: Need to add back the validation rule: (validate.rules).string = {min_len: 1}] Specifies the cluster that requests will be mirrored to. The cluster must exist in the cluster manager configuration.\"\n        },\n        \"cluster_header\": {\n          \"type\": \"string\",\n          \"description\": \"Only one of ``cluster`` and ``cluster_header`` can be specified. Envoy will determine the cluster to route to by reading the value of the HTTP header named by cluster_header from the request headers. Only the first value in header is used, and no shadow request will happen if the value is not found in headers. Envoy will not wait for the shadow cluster to respond before returning the response from the primary cluster. .. attention::   Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1   ``Host`` header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"runtime_fraction\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeFractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"If not specified, all requests to the target cluster will be mirrored. If specified, this field takes precedence over the ``runtime_key`` field and requests must also fall under the percentage of matches indicated by this field. For some fraction N/D, a random number in the range [0,D) is selected. If the number is <= the value of the numerator N, or if the key is not present, the default value, the request will be mirrored.\"\n        },\n        \"trace_sampled\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Specifies whether the trace span for the shadow request should be sampled. If this field is not explicitly set, the shadow request will inherit the sampling decision of its parent span. This ensures consistency with the trace sampling policy of the original request and prevents oversampling, especially in scenarios where runtime sampling is disabled.\"\n        },\n        \"disable_shadow_host_suffix_append\": {\n          \"type\": \"boolean\",\n          \"description\": \"Disables appending the ``-shadow`` suffix to the shadowed ``Host`` header. Defaults to ``false``.\"\n        },\n        \"request_headers_mutations\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.common.mutation_rules.v3.HeaderMutation\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of header mutations that should be applied to each mirrored request. Header mutations are applied in the order they are specified. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"host_rewrite_literal\": {\n          \"type\": \"string\",\n          \"description\": \"Indicates that during mirroring, the host header will be swapped with this value. :ref:`disable_shadow_host_suffix_append ` is implicitly enabled if this field is set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Request Mirror Policy\",\n      \"description\": \"The router is capable of shadowing traffic from one cluster to another. The current implementation is \\\"fire and forget,\\\" meaning Envoy will not wait for the shadow cluster to respond before returning the response from the primary cluster. All normal statistics are collected for the shadow cluster making this feature useful for testing. During shadowing, the host/authority header is altered such that ``-shadow`` is appended. This is useful for logging. For example, ``cluster1`` becomes ``cluster1-shadow``. This behavior can be disabled by setting ``disable_shadow_host_suffix_append`` to ``true``. .. note::   Shadowing will not be triggered if the primary cluster does not exist. .. note::   Shadowing doesn't support HTTP CONNECT and upgrades. [#next-free-field: 9]\"\n    },\n    \"envoy.config.route.v3.RouteAction.UpgradeConfig\": {\n      \"properties\": {\n        \"upgrade_type\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The case-insensitive name of this upgrade, for example, \\\"websocket\\\". For each upgrade type present in upgrade_configs, requests with Upgrade: [upgrade_type] will be proxied upstream.\"\n        },\n        \"enabled\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Determines if upgrades are available on this route. Defaults to ``true``.\"\n        },\n        \"connect_config\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.UpgradeConfig.ConnectConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for sending data upstream as a raw data payload. This is used for CONNECT requests, when forwarding CONNECT payload as raw TCP. Note that CONNECT support is currently considered alpha in Envoy. [#comment: TODO(htuch): Replace the above comment with an alpha tag.]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Upgrade Config\",\n      \"description\": \"Allows enabling and disabling upgrades on a per-route basis. This overrides any enabled/disabled upgrade filter chain specified in the HttpConnectionManager :ref:`upgrade_configs ` but does not affect any custom filter chain specified there.\"\n    },\n    \"envoy.config.route.v3.RouteAction.UpgradeConfig.ConnectConfig\": {\n      \"properties\": {\n        \"proxy_protocol_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ProxyProtocolConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"If present, the proxy protocol header will be prepended to the CONNECT payload sent upstream.\"\n        },\n        \"allow_post\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set, the route will also allow forwarding POST payload as raw TCP.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Connect Config\",\n      \"description\": \"Configuration for sending data upstream as a raw data payload. This is used for CONNECT or POST requests, when forwarding request payload as raw TCP.\"\n    },\n    \"envoy.config.route.v3.RouteConfiguration\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the route configuration. For example, it might match :ref:`route_config_name ` in :ref:`envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.Rds`.\"\n        },\n        \"virtual_hosts\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.VirtualHost\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"An array of virtual hosts that make up the route table.\"\n        },\n        \"vhds\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.Vhds\",\n          \"additionalProperties\": false,\n          \"description\": \"An array of virtual hosts will be dynamically loaded via the VHDS API. Both ``virtual_hosts`` and ``vhds`` fields will be used when present. ``virtual_hosts`` can be used for a base routing table or for infrequently changing virtual hosts. ``vhds`` is used for on-demand discovery of virtual hosts. The contents of these two fields will be merged to generate a routing table for a given RouteConfiguration, with ``vhds`` derived configuration taking precedence.\"\n        },\n        \"internal_only_headers\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Optionally specifies a list of HTTP headers that the connection manager will consider to be internal only. If they are found on external requests they will be cleaned prior to filter invocation. See :ref:`config_http_conn_man_headers_x-envoy-internal` for more information.\"\n        },\n        \"response_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be added to each response that the connection manager encodes. Headers specified at this level are applied after headers from any enclosed :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` or :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"response_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each response that the connection manager encodes.\"\n        },\n        \"request_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be added to each request routed by the HTTP connection manager. Headers specified at this level are applied after headers from any enclosed :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` or :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"request_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each request routed by the HTTP connection manager.\"\n        },\n        \"most_specific_header_mutations_wins\": {\n          \"type\": \"boolean\",\n          \"description\": \"Headers mutations at all levels are evaluated, if specified. By default, the order is from most specific (i.e. route entry level) to least specific (i.e. route configuration level). Later header mutations may override earlier mutations. This order can be reversed by setting this field to true. In other words, most specific level mutation is evaluated last.\"\n        },\n        \"validate_clusters\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"An optional boolean that specifies whether the clusters that the route table refers to will be validated by the cluster manager. If set to true and a route refers to a non-existent cluster, the route table will not load. If set to false and a route refers to a non-existent cluster, the route table will load and the router filter will return a 404 if the route is selected at runtime. This setting defaults to true if the route table is statically defined via the :ref:`route_config ` option. This setting default to false if the route table is loaded dynamically via the :ref:`rds ` option. Users may wish to override the default behavior in certain cases (for example when using CDS with a static route table).\"\n        },\n        \"max_direct_response_body_size_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum bytes of the response :ref:`direct response body ` size. If not specified the default is 4096. .. warning::   Envoy currently holds the content of :ref:`direct response body   ` in memory. Be careful setting   this to be larger than the default 4KB, since the allocated memory for direct response body   is not subject to data plane buffering controls.\"\n        },\n        \"cluster_specifier_plugins\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.ClusterSpecifierPlugin\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of plugins and their configurations which may be used by a :ref:`cluster specifier plugin name ` within the route. All ``extension.name`` fields in this list must be unique.\"\n        },\n        \"request_mirror_policies\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.RequestMirrorPolicy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specify a set of default request mirroring policies which apply to all routes under its virtual hosts. Note that policies are not merged, the most specific non-empty one becomes the mirror policies.\"\n        },\n        \"ignore_port_in_host_matching\": {\n          \"type\": \"boolean\",\n          \"description\": \"By default, port in :authority header (if any) is used in host matching. With this option enabled, Envoy will ignore the port number in the :authority header (if any) when picking VirtualHost. .. note::     This option will not strip the port number (if any) contained in route config     :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`.domains field.\"\n        },\n        \"vhost_header\": {\n          \"type\": \"string\",\n          \"description\": \"Normally, virtual host matching is done using the :authority (or Host: in HTTP < 2) HTTP header. Setting this will instead, use a different HTTP header for this purpose.\"\n        },\n        \"ignore_path_parameters_in_path_matching\": {\n          \"type\": \"boolean\",\n          \"description\": \"Ignore path-parameters in path-matching. Before RFC3986, URI were like(RFC1808): :///;?# Envoy by default takes \\\":path\\\" as \\\";\\\". For users who want to only match path on the \\\"\\\" portion, this option should be true.\"\n        },\n        \"typed_per_filter_config\": {\n          \"additionalProperties\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"type\": \"object\",\n          \"description\": \"This field can be used to provide RouteConfiguration level per filter config. The key should match the :ref:`filter config name `. See :ref:`Http filter route specific config ` for details. [#comment: An entry's value may be wrapped in a :ref:`FilterConfig` message to specify additional options.]\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"The metadata field can be used to provide additional information about the route configuration. It can be used for configuration, stats, and logging. The metadata should go under the filter namespace that will need it. For instance, if the metadata is intended for the Router filter, the filter name should be specified as ``envoy.filters.http.router``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: HTTP route configuration]\\n * Routing :ref:`architecture overview `\\n * HTTP :ref:`router filter `\",\n      \"description\": \"[#protodoc-title: HTTP route configuration] * Routing :ref:`architecture overview ` * HTTP :ref:`router filter `  [#next-free-field: 19]\"\n    },\n    \"envoy.config.route.v3.RouteMatch\": {\n      \"properties\": {\n        \"prefix\": {\n          \"type\": \"string\",\n          \"description\": \"If specified, the route is a prefix rule meaning that the prefix must match the beginning of the ``:path`` header.\"\n        },\n        \"path\": {\n          \"type\": \"string\",\n          \"description\": \"If specified, the route is an exact path rule meaning that the path must exactly match the ``:path`` header once the query string is removed.\"\n        },\n        \"safe_regex\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, the route is a regular expression rule meaning that the regex must match the ``:path`` header once the query string is removed. The entire path (without the query string) must match the regex. The rule will not match if only a subsequence of the ``:path`` header matches the regex. [#next-major-version: In the v3 API we should redo how path specification works such that we utilize StringMatcher, and additionally have consistent options around whether we strip query strings, do a case-sensitive match, etc. In the interim it will be too disruptive to deprecate the existing options. We should even consider whether we want to do away with path_specifier entirely and just rely on a set of header matchers which can already match on :path, etc. The issue with that is it is unclear how to generically deal with query string stripping. This needs more thought.]\"\n        },\n        \"connect_matcher\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteMatch.ConnectMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"If this is used as the matcher, the matcher will only match CONNECT or CONNECT-UDP requests. Note that this will not match other Extended CONNECT requests (WebSocket and the like) as they are normalized in Envoy as HTTP/1.1 style upgrades. This is the only way to match CONNECT requests for HTTP/1.1. For HTTP/2 and HTTP/3, where Extended CONNECT requests may have a path, the path matchers will work if there is a path present. Note that CONNECT support is currently considered alpha in Envoy. [#comment: TODO(htuch): Replace the above comment with an alpha tag.]\"\n        },\n        \"path_separated_prefix\": {\n          \"pattern\": \"^[^?#]+[^?#/]$\",\n          \"type\": \"string\",\n          \"description\": \"If specified, the route is a path-separated prefix rule meaning that the ``:path`` header (without the query string) must either exactly match the ``path_separated_prefix`` or have it as a prefix, followed by ``/`` For example, ``/api/dev`` would match ``/api/dev``, ``/api/dev/``, ``/api/dev/v1``, and ``/api/dev?param=true`` but would not match ``/api/developer`` Expect the value to not contain ``?`` or ``#`` and not to end in ``/``\"\n        },\n        \"path_match_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"[#extension-category: envoy.path.match]\"\n        },\n        \"case_sensitive\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Indicates that prefix/path matching should be case-sensitive. The default is true. Ignored for safe_regex matching.\"\n        },\n        \"runtime_fraction\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RuntimeFractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that the route should additionally match on a runtime key. Every time the route is considered for a match, it must also fall under the percentage of matches indicated by this field. For some fraction N/D, a random number in the range [0,D) is selected. If the number is <= the value of the numerator N, or if the key is not present, the default value, the router continues to evaluate the remaining match criteria. A runtime_fraction route configuration can be used to roll out route changes in a gradual manner without full code/config deploys. Refer to the :ref:`traffic shifting ` docs for additional documentation. .. note::    Parsing this field is implemented such that the runtime key's data may be represented    as a FractionalPercent proto represented as JSON/YAML and may also be represented as an    integer with the assumption that the value is an integral percentage out of 100. For    instance, a runtime key lookup returning the value \\\"42\\\" would parse as a FractionalPercent    whose numerator is 42 and denominator is HUNDRED. This preserves legacy semantics.\"\n        },\n        \"headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of headers that the route should match on. The router will check the request\u2019s headers against all the specified headers in the route config. A match will happen if all the headers in the route are present in the request with the same values (or based on presence if the value field is not in the config).\"\n        },\n        \"query_parameters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.QueryParameterMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of URL query parameters on which the route should match. The router will check the query string from the ``path`` header against all the specified query parameters. If the number of specified query parameters is nonzero, they all must match the ``path`` header's query string for a match to occur. In the event query parameters are repeated, only the first value for each key will be considered. .. note::    If query parameters are used to pass request message fields when    `grpc_json_transcoder `_    is used, the transcoded message fields may be different. The query parameters are    URL-encoded, but the message fields are not. For example, if a query    parameter is \\\"foo%20bar\\\", the message field will be \\\"foo bar\\\".\"\n        },\n        \"cookies\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.CookieMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of cookies on which the route should match. The router parses the ``Cookie`` header and evaluates the named cookie against each matcher. If the number of specified cookie matchers is nonzero, they all must match for the route to be selected.\"\n        },\n        \"grpc\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteMatch.GrpcRouteMatchOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, only gRPC requests will be matched. The router will check that the ``Content-Type`` header has ``application/grpc`` or one of the various ``application/grpc+`` values.\"\n        },\n        \"tls_context\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteMatch.TlsContextMatchOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, the client tls context will be matched against the defined match options. [#next-major-version: unify with RBAC]\"\n        },\n        \"dynamic_metadata\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.MetadataMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of dynamic metadata matchers on which the route should match. The router will check the dynamic metadata against all the specified dynamic metadata matchers. If the number of specified dynamic metadata matchers is nonzero, they all must match the dynamic metadata for a match to occur.\"\n        },\n        \"filter_state\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.matcher.v3.FilterStateMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of filter state matchers on which the route should match. The router will check the filter state against all the specified filter state matchers. If the number of specified filter state matchers is nonzero, they all must match the filter state for a match to occur.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Route Match\",\n      \"description\": \"[#next-free-field: 18]\"\n    },\n    \"envoy.config.route.v3.RouteMatch.ConnectMatcher\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Connect Matcher\",\n      \"description\": \"An extensible message for matching CONNECT or CONNECT-UDP requests.\"\n    },\n    \"envoy.config.route.v3.RouteMatch.GrpcRouteMatchOptions\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Grpc Route Match Options\"\n    },\n    \"envoy.config.route.v3.RouteMatch.TlsContextMatchOptions\": {\n      \"properties\": {\n        \"presented\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If specified, the route will match against whether or not a certificate is presented. If not specified, certificate presentation status (true or false) will not be considered when route matching.\"\n        },\n        \"validated\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If specified, the route will match against whether or not a certificate is validated. If not specified, certificate validation status (true or false) will not be considered when route matching. .. warning::    Client certificate validation is not currently performed upon TLS session resumption. For    a resumed TLS session the route will match only when ``validated`` is false, regardless of    whether the client TLS certificate is valid.    The only known workaround for this issue is to disable TLS session resumption entirely, by    setting both :ref:`disable_stateless_session_resumption `    and :ref:`disable_stateful_session_resumption ` on the DownstreamTlsContext.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tls Context Match Options\"\n    },\n    \"envoy.config.route.v3.ScopedRouteConfiguration\": {\n      \"properties\": {\n        \"on_demand\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether the RouteConfiguration should be loaded on demand.\"\n        },\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name assigned to the routing scope.\"\n        },\n        \"route_configuration_name\": {\n          \"type\": \"string\",\n          \"description\": \"The resource name to use for a :ref:`envoy_v3_api_msg_service.discovery.v3.DiscoveryRequest` to an RDS server to fetch the :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration` associated with this scope.\"\n        },\n        \"route_configuration\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteConfiguration\",\n          \"additionalProperties\": false,\n          \"description\": \"The :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration` associated with the scope.\"\n        },\n        \"key\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.ScopedRouteConfiguration.Key\",\n          \"additionalProperties\": false,\n          \"description\": \"The key to match against.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: HTTP scoped routing configuration]\\n * Routing :ref:`architecture overview `\",\n      \"description\": \"[#protodoc-title: HTTP scoped routing configuration] * Routing :ref:`architecture overview `  Specifies a routing scope, which associates a :ref:`Key` to a :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. The :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration` can be obtained dynamically via RDS (:ref:`route_configuration_name`) or specified inline (:ref:`route_configuration`). The HTTP connection manager builds up a table consisting of these Key to RouteConfiguration mappings, and looks up the RouteConfiguration to use per request according to the algorithm specified in the :ref:`scope_key_builder` assigned to the HttpConnectionManager. For example, with the following configurations (in YAML): HttpConnectionManager config: .. code::   ...   scoped_routes:     name: foo-scoped-routes     scope_key_builder:       fragments:         - header_value_extractor:             name: X-Route-Selector             element_separator: \\\",\\\"             element:               separator: =               key: vip ScopedRouteConfiguration resources (specified statically via :ref:`scoped_route_configurations_list` or obtained dynamically via SRDS): .. code::  (1)   name: route-scope1   route_configuration_name: route-config1   key:      fragments:        - string_key: 172.10.10.20  (2)   name: route-scope2   route_configuration_name: route-config2   key:     fragments:       - string_key: 172.20.20.30 A request from a client such as: .. code::     GET / HTTP/1.1     Host: foo.com     X-Route-Selector: vip=172.10.10.20 would result in the routing table defined by the ``route-config1`` RouteConfiguration being assigned to the HTTP request/stream. [#next-free-field: 6]\"\n    },\n    \"envoy.config.route.v3.ScopedRouteConfiguration.Key\": {\n      \"properties\": {\n        \"fragments\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.ScopedRouteConfiguration.Key.Fragment\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The ordered set of fragments to match against. The order must match the fragments in the corresponding :ref:`scope_key_builder`.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Key\",\n      \"description\": \"Specifies a key which is matched against the output of the :ref:`scope_key_builder` specified in the HttpConnectionManager. The matching is done per HTTP request and is dependent on the order of the fragments contained in the Key.\"\n    },\n    \"envoy.config.route.v3.ScopedRouteConfiguration.Key.Fragment\": {\n      \"properties\": {\n        \"string_key\": {\n          \"type\": \"string\",\n          \"description\": \"A string to match against.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Fragment\"\n    },\n    \"envoy.config.route.v3.Tracing\": {\n      \"properties\": {\n        \"client_sampling\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Target percentage of requests managed by this HTTP connection manager that will be force traced if the :ref:`x-client-trace-id ` header is set. This field is a direct analog for the runtime variable 'tracing.client_enabled' in the :ref:`HTTP Connection Manager `. Default: 100%\"\n        },\n        \"random_sampling\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Target percentage of requests managed by this HTTP connection manager that will be randomly selected for trace generation, if not requested by the client or not forced. This field is a direct analog for the runtime variable 'tracing.random_sampling' in the :ref:`HTTP Connection Manager `. Default: 100%\"\n        },\n        \"overall_sampling\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.FractionalPercent\",\n          \"additionalProperties\": false,\n          \"description\": \"Target percentage of requests managed by this HTTP connection manager that will be traced after all other sampling checks have been applied (client-directed, force tracing, random sampling). This field functions as an upper limit on the total configured sampling rate. For instance, setting client_sampling to 100% but overall_sampling to 1% will result in only 1% of client requests with the appropriate headers to be force traced. This field is a direct analog for the runtime variable 'tracing.global_enabled' in the :ref:`HTTP Connection Manager `. Default: 100%\"\n        },\n        \"custom_tags\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.tracing.v3.CustomTag\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of custom tags with unique tag name to create tags for the active span. It will take effect after merging with the :ref:`corresponding configuration ` configured in the HTTP connection manager. If two tags with the same name are configured each in the HTTP connection manager and the route level, the one configured here takes priority.\"\n        },\n        \"operation\": {\n          \"type\": \"string\",\n          \"description\": \"The operation name of the span which will be used for tracing. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. This field will take precedence over and make following settings ineffective: * :ref:`route decorator `. * :ref:`x-envoy-decorator-operation `. * :ref:`HCM tracing operation   `.\"\n        },\n        \"upstream_operation\": {\n          \"type\": \"string\",\n          \"description\": \"The operation name of the upstream span which will be used for tracing. This only takes effect when ``spawn_upstream_span`` is set to true and the upstream span is created. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. This field will take precedence over and make following settings ineffective: * :ref:`HCM tracing upstream operation   `\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tracing\",\n      \"description\": \"[#next-free-field: 7]\"\n    },\n    \"envoy.config.route.v3.Vhds\": {\n      \"properties\": {\n        \"config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for VHDS.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Vhds\"\n    },\n    \"envoy.config.route.v3.VirtualCluster\": {\n      \"properties\": {\n        \"headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of header matchers to use for matching requests. Each specified header must match. The pseudo-headers ``:path`` and ``:method`` can be used to match the request path and method, respectively.\"\n        },\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Specifies the name of the virtual cluster. The virtual cluster name as well as the virtual host name are used when emitting statistics. The statistics are emitted by the router filter and are documented :ref:`here `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Virtual Cluster\",\n      \"description\": \"A virtual cluster is a way of specifying a regex matching rule against certain important endpoints such that statistics are generated explicitly for the matched requests. The reason this is useful is that when doing prefix/path matching Envoy does not always know what the application considers to be an endpoint. Thus, it\u2019s impossible for Envoy to generically emit per endpoint statistics. However, often systems have highly critical endpoints that they wish to get \u201cperfect\u201d statistics on. Virtual cluster statistics are perfect in the sense that they are emitted on the downstream side such that they include network level failures. Documentation for :ref:`virtual cluster statistics `. .. note::    Virtual clusters are a useful tool, but we do not recommend setting up a virtual cluster for    every application endpoint. This is both not easily maintainable and as well the matching and    statistics output are not free.\"\n    },\n    \"envoy.config.route.v3.VirtualHost\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The logical name of the virtual host. This is used when emitting certain statistics but is not relevant for routing.\"\n        },\n        \"domains\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"minItems\": 1,\n          \"type\": \"array\",\n          \"description\": \"A list of domains (host/authority header) that will be matched to this virtual host. Wildcard hosts are supported in the suffix or prefix form. Domain search order:  1. Exact domain names: ``www.foo.com``.  2. Suffix domain wildcards: ``*.foo.com`` or ``*-bar.foo.com``.  3. Prefix domain wildcards: ``foo.*`` or ``foo-*``.  4. Special wildcard ``*`` matching any domain. .. note::   The wildcard will not match the empty string.   For example, ``*-bar.foo.com`` will match ``baz-bar.foo.com`` but not ``-bar.foo.com``.   The longest wildcards match first.   Only a single virtual host in the entire route configuration can match on ``*``. A domain   must be unique across all virtual hosts or the config will fail to load. Domains cannot contain control characters. This is validated by the well_known_regex HTTP_HEADER_VALUE.\"\n        },\n        \"routes\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.Route\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The list of routes that will be matched, in order, for incoming requests. The first route that matches will be used. Only one of this and ``matcher`` can be specified.\"\n        },\n        \"matcher\": {\n          \"$ref\": \"#/definitions/xds.type.matcher.v3.Matcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The match tree to use when resolving route actions for incoming requests. Only one of this and ``routes`` can be specified.\"\n        },\n        \"require_tls\": {\n          \"enum\": [\n            \"NONE\",\n            0,\n            \"EXTERNAL_ONLY\",\n            1,\n            \"ALL\",\n            2\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Tls Requirement Type\"\n        },\n        \"virtual_clusters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.VirtualCluster\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of virtual clusters defined for this virtual host. Virtual clusters are used for additional statistics gathering.\"\n        },\n        \"rate_limits\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RateLimit\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a set of rate limit configurations that will be applied to the virtual host.\"\n        },\n        \"request_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be added to each request handled by this virtual host. Headers specified at this level are applied after headers from enclosed :ref:`envoy_v3_api_msg_config.route.v3.Route` and before headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"request_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each request handled by this virtual host.\"\n        },\n        \"response_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be added to each response handled by this virtual host. Headers specified at this level are applied after headers from enclosed :ref:`envoy_v3_api_msg_config.route.v3.Route` and before headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"response_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each response handled by this virtual host.\"\n        },\n        \"cors\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.CorsPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates that the virtual host has a CORS policy. This field is ignored if related cors policy is found in the :ref:`VirtualHost.typed_per_filter_config`. .. attention::   This option has been deprecated. Please use   :ref:`VirtualHost.typed_per_filter_config`   to configure the CORS HTTP filter.\"\n        },\n        \"typed_per_filter_config\": {\n          \"additionalProperties\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"type\": \"object\",\n          \"description\": \"This field can be used to provide virtual host level per filter config. The key should match the :ref:`filter config name `. See :ref:`HTTP filter route-specific config ` for details. [#comment: An entry's value may be wrapped in a :ref:`FilterConfig` message to specify additional options.]\"\n        },\n        \"include_request_attempt_count\": {\n          \"type\": \"boolean\",\n          \"description\": \"Decides whether the :ref:`x-envoy-attempt-count ` header should be included in the upstream request. Setting this option will cause it to override any existing header value, so in the case of two Envoys on the request path with this option enabled, the upstream will see the attempt count as perceived by the second Envoy. Defaults to ``false``. This header is unaffected by the :ref:`suppress_envoy_headers ` flag. [#next-major-version: rename to include_attempt_count_in_request.]\"\n        },\n        \"include_attempt_count_in_response\": {\n          \"type\": \"boolean\",\n          \"description\": \"Decides whether the :ref:`x-envoy-attempt-count ` header should be included in the downstream response. Setting this option will cause the router to override any existing header value, so in the case of two Envoys on the request path with this option enabled, the downstream will see the attempt count as perceived by the Envoy closest upstream from itself. Defaults to ``false``. This header is unaffected by the :ref:`suppress_envoy_headers ` flag.\"\n        },\n        \"retry_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates the retry policy for all routes in this virtual host. Note that setting a route level entry will take precedence over this config and it'll be treated independently (e.g., values are not inherited).\"\n        },\n        \"retry_policy_typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"hedge_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.HedgePolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Indicates the hedge policy for all routes in this virtual host. Note that setting a route level entry will take precedence over this config and it'll be treated independently (e.g., values are not inherited).\"\n        },\n        \"include_is_timeout_retry_header\": {\n          \"type\": \"boolean\",\n          \"description\": \"Decides whether to include the :ref:`x-envoy-is-timeout-retry ` request header in retries initiated by per-try timeouts.\"\n        },\n        \"per_request_buffer_limit_bytes\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum bytes which will be buffered for retries and shadowing. If set, the bytes actually buffered will be the minimum value of this and the listener ``per_connection_buffer_limit_bytes``. .. attention::   This field has been deprecated. Please use :ref:`request_body_buffer_limit   ` instead.   Only one of ``per_request_buffer_limit_bytes`` and ``request_body_buffer_limit`` could be set.\"\n        },\n        \"request_body_buffer_limit\": {\n          \"additionalProperties\": false,\n          \"type\": \"string\",\n          \"description\": \"The maximum bytes which will be buffered for request bodies to support large request body buffering beyond the ``per_connection_buffer_limit_bytes``. This limit is specifically for the request body buffering and allows buffering larger payloads while maintaining flow control. Buffer limit precedence (from highest to lowest priority): 1. If ``request_body_buffer_limit`` is set, then ``request_body_buffer_limit`` will be used. 2. If :ref:`per_request_buffer_limit_bytes `    is set but ``request_body_buffer_limit`` is not, then ``min(per_request_buffer_limit_bytes, per_connection_buffer_limit_bytes)``    will be used. 3. If neither is set, then ``per_connection_buffer_limit_bytes`` will be used. For flow control chunk sizes, ``min(per_connection_buffer_limit_bytes, 16KB)`` will be used. Only one of :ref:`per_request_buffer_limit_bytes ` and ``request_body_buffer_limit`` could be set.\"\n        },\n        \"request_mirror_policies\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.RequestMirrorPolicy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specify a set of default request mirroring policies for every route under this virtual host. It takes precedence over the route config mirror policy entirely. That is, policies are not merged, the most specific non-empty one becomes the mirror policies.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"The metadata field can be used to provide additional information about the virtual host. It can be used for configuration, stats, and logging. The metadata should go under the filter namespace that will need it. For instance, if the metadata is intended for the Router filter, the filter name should be specified as ``envoy.filters.http.router``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: HTTP route components]\\n * Routing :ref:`architecture overview `\\n * HTTP :ref:`router filter `\",\n      \"description\": \"[#protodoc-title: HTTP route components] * Routing :ref:`architecture overview ` * HTTP :ref:`router filter `  The top level element in the routing configuration is a virtual host. Each virtual host has a logical name as well as a set of domains that get routed to it based on the incoming request's host header. This allows a single listener to service multiple top level domain path trees. Once a virtual host is selected based on the domain, the routes are processed in order to see which upstream cluster to route to or whether to perform a redirect. [#next-free-field: 26]\"\n    },\n    \"envoy.config.route.v3.WeightedCluster\": {\n      \"properties\": {\n        \"clusters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.WeightedCluster.ClusterWeight\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies one or more upstream clusters associated with the route.\"\n        },\n        \"total_weight\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Specifies the total weight across all clusters. The sum of all cluster weights must equal this value, if this is greater than 0. This field is now deprecated, and the client will use the sum of all cluster weights. It is up to the management server to supply the correct weights.\"\n        },\n        \"runtime_key_prefix\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the runtime key prefix that should be used to construct the runtime keys associated with each cluster. When the ``runtime_key_prefix`` is specified, the router will look for weights associated with each upstream cluster under the key ``runtime_key_prefix`` + ``.`` + ``cluster[i].name`` where ``cluster[i]`` denotes an entry in the clusters array field. If the runtime key for the cluster does not exist, the value specified in the configuration file will be used as the default weight. See the :ref:`runtime documentation ` for how key names map to the underlying implementation.\"\n        },\n        \"header_name\": {\n          \"type\": \"string\",\n          \"description\": \"Specifies the header name that is used to look up the random value passed in the request header. This is used to ensure consistent cluster picking across multiple proxy levels for weighted traffic. If header is not present or invalid, Envoy will fall back to use the internally generated random value. This header is expected to be single-valued header as we only want to have one selected value throughout the process for the consistency. And the value is a unsigned number between 0 and UINT64_MAX.\"\n        },\n        \"use_hash_policy\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"When set to true, the hash policies will be used to generate the random value for weighted cluster selection. This could ensure consistent cluster picking across multiple proxy levels for weighted traffic.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Weighted Cluster\",\n      \"description\": \"Compared to the :ref:`cluster ` field that specifies a single upstream cluster as the target of a request, the :ref:`weighted_clusters ` option allows for specification of multiple upstream clusters along with weights that indicate the percentage of traffic to be forwarded to each cluster. The router selects an upstream cluster based on the weights. [#next-free-field: 6]\"\n    },\n    \"envoy.config.route.v3.WeightedCluster.ClusterWeight\": {\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"description\": \"Only one of ``name`` and ``cluster_header`` may be specified. [#next-major-version: Need to add back the validation rule: (validate.rules).string = {min_len: 1}] Name of the upstream cluster. The cluster must exist in the :ref:`cluster manager configuration `.\"\n        },\n        \"cluster_header\": {\n          \"type\": \"string\",\n          \"description\": \"Only one of ``name`` and ``cluster_header`` may be specified. [#next-major-version: Need to add back the validation rule: (validate.rules).string = {min_len: 1 }] Envoy will determine the cluster to route to by reading the value of the HTTP header named by cluster_header from the request headers. If the header is not found or the referenced cluster does not exist, Envoy will return a 404 response. .. attention::   Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1   ``Host`` header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"weight\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The weight of the cluster. This value is relative to the other clusters' weights. When a request matches the route, the choice of an upstream cluster is determined by its weight. The sum of weights across all entries in the clusters array must be greater than 0, and must not exceed uint32_t maximal value (4294967295).\"\n        },\n        \"metadata_match\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"Optional endpoint metadata match criteria used by the subset load balancer. Only endpoints in the upstream cluster with metadata matching what is set in this field will be considered for load balancing. Note that this will be merged with what's provided in :ref:`RouteAction.metadata_match `, with values here taking precedence. The filter name should be specified as ``envoy.lb``.\"\n        },\n        \"request_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of headers to be added to requests when this cluster is selected through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. Headers specified at this level are applied before headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.Route`, :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`, and :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"request_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers that should be removed from each request when this cluster is selected through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`.\"\n        },\n        \"response_headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of headers to be added to responses when this cluster is selected through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. Headers specified at this level are applied before headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.Route`, :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`, and :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on header value syntax, see the documentation on :ref:`custom request headers `.\"\n        },\n        \"response_headers_to_remove\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of headers to be removed from responses when this cluster is selected through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`.\"\n        },\n        \"typed_per_filter_config\": {\n          \"additionalProperties\": {\n            \"type\": \"object\",\n            \"required\": [\n              \"@type\"\n            ],\n            \"properties\": {\n              \"@type\": {\n                \"type\": \"string\",\n                \"examples\": [\n                  \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                  \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                  \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                  \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                ]\n              }\n            },\n            \"allOf\": [\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpConnectionManager\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Router\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/JwtAuthentication\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/Cors\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/HttpProtocolOptions\"\n                }\n              },\n              {\n                \"if\": {\n                  \"properties\": {\n                    \"@type\": {\n                      \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                    }\n                  }\n                },\n                \"then\": {\n                  \"$ref\": \"#/definitions/StdoutAccessLog\"\n                }\n              }\n            ]\n          },\n          \"type\": \"object\",\n          \"description\": \"This field can be used to provide weighted cluster specific per filter config. The key should match the :ref:`filter config name `. See :ref:`HTTP filter route-specific config ` for details. [#comment: An entry's value may be wrapped in a :ref:`FilterConfig` message to specify additional options.]\"\n        },\n        \"host_rewrite_literal\": {\n          \"type\": \"string\",\n          \"description\": \"Indicates that during forwarding, the host header will be swapped with this value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cluster Weight\",\n      \"description\": \"[#next-free-field: 13]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ForwardProtoConfig\": {\n      \"properties\": {\n        \"https_destination_ports\": {\n          \"items\": {\n            \"type\": \"integer\"\n          },\n          \"type\": \"array\",\n          \"description\": \"List of destination ports that should be treated as HTTPS. When the PROXY protocol destination port matches one of these ports, ``x-forwarded-proto`` will be set to ``https``. Common values: 443, 8443\"\n        },\n        \"http_destination_ports\": {\n          \"items\": {\n            \"type\": \"integer\"\n          },\n          \"type\": \"array\",\n          \"description\": \"List of destination ports that should be treated as HTTP. When the PROXY protocol destination port matches one of these ports, ``x-forwarded-proto`` will be set to ``http``. Common values: 80, 8080\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Forward Proto Config\",\n      \"description\": \"Configuration options for setting the ``x-forwarded-proto`` header. This message provides flexibility for future enhancements to protocol inference.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.HcmAccessLogOptions\": {\n      \"properties\": {\n        \"access_log_flush_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval to flush the above access logs. By default, the HCM will flush exactly one access log on stream close, when the HTTP request is complete. If this field is set, the HCM will flush access logs periodically at the specified interval. This is especially useful in the case of long-lived requests, such as CONNECT and Websockets. Final access logs can be detected via the ``requestComplete()`` method of ``StreamInfo`` in access log filters, or through the ``%DURATION%`` substitution string. The interval must be at least 1 millisecond.\",\n          \"format\": \"regex\"\n        },\n        \"flush_access_log_on_new_request\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, HCM will flush an access log when a new HTTP request is received, after request headers have been evaluated, before iterating through the HTTP filter chain. This log record, if enabled, does not depend on periodic log records or request completion log. Details related to upstream cluster, such as upstream host, will not be available for this log.\"\n        },\n        \"flush_log_on_tunnel_successfully_established\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the HCM will flush an access log when a tunnel is successfully established. For example, this could be when an upstream has successfully returned 101 Switching Protocols, or when the proxy has returned 200 to a CONNECT request.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Hcm Access Log Options\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig\": {\n      \"properties\": {\n        \"unix_sockets\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether unix socket addresses should be considered internal.\"\n        },\n        \"cidr_ranges\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.CidrRange\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"List of CIDR ranges that are treated as internal. If unset, then RFC1918 / RFC4193 IP addresses will be considered internal.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Internal Address Config\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions\": {\n      \"properties\": {\n        \"forwarding_transformation\": {\n          \"$ref\": \"#/definitions/envoy.type.http.v3.PathTransformation\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] Normalization applies internally before any processing of requests by HTTP filters, routing, and matching *and* will affect the forwarded ``:path`` header. Defaults to :ref:`NormalizePathRFC3986 `. When not specified, this value may be overridden by the runtime variable :ref:`http_connection_manager.normalize_path`. Envoy will respond with 400 to paths that are malformed (e.g. for paths that fail RFC 3986 normalization due to disallowed characters.)\"\n        },\n        \"http_filter_transformation\": {\n          \"$ref\": \"#/definitions/envoy.type.http.v3.PathTransformation\",\n          \"additionalProperties\": false,\n          \"description\": \"[#not-implemented-hide:] Normalization only applies internally before any processing of requests by HTTP filters, routing, and matching. These will be applied after full transformation is applied. The ``:path`` header before this transformation will be restored in the router filter and sent upstream unless it was mutated by a filter. Defaults to no transformations. Multiple actions can be applied in the same Transformation, forming a sequential pipeline. The transformations will be performed in the order that they appear. Envoy will respond with 400 to paths that are malformed (e.g. for paths that fail RFC 3986 normalization due to disallowed characters.)\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Path Normalization Options\",\n      \"description\": \"[#not-implemented-hide:] Transformations that apply to path headers. Transformations are applied before any processing of requests by HTTP filters, routing, and matching. Only the normalized path will be visible internally if a transformation is enabled. Any path rewrites that the router performs (e.g. :ref:`regex_rewrite ` or :ref:`prefix_rewrite `) will apply to the ``:path`` header destined for the upstream. .. note::   Access logging and tracing will show the original ``:path`` header.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig\": {\n      \"properties\": {\n        \"remove_details\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the details field of the Proxy-Status header is not populated with stream_info.response_code_details. This value defaults to ``false``, i.e. the ``details`` field is populated by default.\"\n        },\n        \"remove_connection_termination_details\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the details field of the Proxy-Status header will not contain connection termination details. This value defaults to ``false``, i.e. the ``details`` field will contain connection termination details by default.\"\n        },\n        \"remove_response_flags\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the details field of the Proxy-Status header will not contain an enumeration of the Envoy ResponseFlags. This value defaults to ``false``, i.e. the ``details`` field will contain a list of ResponseFlags by default.\"\n        },\n        \"set_recommended_response_code\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, overwrites the existing Status header with the response code recommended by the Proxy-Status spec. This value defaults to ``false``, i.e. the HTTP response code is not overwritten.\"\n        },\n        \"use_node_id\": {\n          \"type\": \"boolean\",\n          \"description\": \"If ``use_node_id`` is set, Proxy-Status headers will use the Envoy's node ID as the name of the proxy.\"\n        },\n        \"literal_proxy_name\": {\n          \"type\": \"string\",\n          \"description\": \"If ``literal_proxy_name`` is set, Proxy-Status headers will use this value as the name of the proxy.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Proxy Status Config\",\n      \"description\": \"Configures the manner in which the Proxy-Status HTTP response header is populated. See the [Proxy-Status RFC](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-proxy-status-08). [#comment:TODO: Update this with the non-draft URL when finalized.] The Proxy-Status header is a string of the form:   \\\"; error=; details=\n\\\" [#next-free-field: 7]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails\": {\n      \"properties\": {\n        \"subject\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether to forward the subject of the client cert. Defaults to false.\"\n        },\n        \"cert\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to forward the entire client cert in URL encoded PEM format. This will appear in the XFCC header comma separated from other values with the value Cert=\\\"PEM\\\". Defaults to false.\"\n        },\n        \"chain\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to forward the entire client cert chain (including the leaf cert) in URL encoded PEM format. This will appear in the XFCC header comma separated from other values with the value Chain=\\\"PEM\\\". Defaults to false.\"\n        },\n        \"dns\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to forward the DNS type Subject Alternative Names of the client cert. Defaults to false.\"\n        },\n        \"uri\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to forward the URI type Subject Alternative Name of the client cert. Defaults to false.\"\n        },\n        \"format\": {\n          \"enum\": [\n            \"TEXT\",\n            0,\n            \"JSON\",\n            1\n          ],\n          \"oneOf\": [\n            {\n              \"type\": \"string\"\n            },\n            {\n              \"type\": \"integer\"\n            }\n          ],\n          \"title\": \"Forward Client Cert Format\",\n          \"description\": \"The format to use when writing the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) header value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Set Current Client Cert Details\",\n      \"description\": \"[#next-free-field: 8]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing\": {\n      \"properties\": {\n        \"client_sampling\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Target percentage of requests managed by this HTTP connection manager that will be force traced if the :ref:`x-client-trace-id ` header is set. This field is a direct analog for the runtime variable 'tracing.client_enabled' in the :ref:`HTTP Connection Manager `. Default: 100%\"\n        },\n        \"random_sampling\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Target percentage of requests managed by this HTTP connection manager that will be randomly selected for trace generation, if not requested by the client or not forced. This field is a direct analog for the runtime variable 'tracing.random_sampling' in the :ref:`HTTP Connection Manager `. Default: 100%\"\n        },\n        \"overall_sampling\": {\n          \"$ref\": \"#/definitions/envoy.type.v3.Percent\",\n          \"additionalProperties\": false,\n          \"description\": \"Target percentage of requests managed by this HTTP connection manager that will be traced after all other sampling checks have been applied (client-directed, force tracing, random sampling). This field functions as an upper limit on the total configured sampling rate. For instance, setting client_sampling to 100% but overall_sampling to 1% will result in only 1% of client requests with the appropriate headers to be force traced. This field is a direct analog for the runtime variable 'tracing.global_enabled' in the :ref:`HTTP Connection Manager `. Default: 100%\"\n        },\n        \"verbose\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to annotate spans with additional data. If true, spans will include logs for stream events.\"\n        },\n        \"max_path_tag_length\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Maximum length of the request path to extract and include in the HttpUrl tag. Used to truncate lengthy request paths to meet the needs of a tracing backend. Default: 256\"\n        },\n        \"custom_tags\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.tracing.v3.CustomTag\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of custom tags with unique tag name to create tags for the active span.\"\n        },\n        \"provider\": {\n          \"$ref\": \"#/definitions/envoy.config.trace.v3.Tracing.Http\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration for an external tracing provider. If not specified, no tracing will be performed.\"\n        },\n        \"spawn_upstream_span\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Create separate tracing span for each upstream request if true. And if this flag is set to true, the tracing provider will assume that Envoy will be independent hop in the trace chain and may set span type to client or server based on this flag. This will deprecate the :ref:`start_child_span ` in the router. Users should set appropriate value based on their tracing provider and actual scenario: * If Envoy is used as sidecar and users want to make the sidecar and its application as only one   hop in the trace chain, this flag should be set to false. And please also make sure the   :ref:`start_child_span `   in the router is not set to true. * If Envoy is used as gateway or independent proxy, or users want to make the sidecar and its   application as different hops in the trace chain, this flag should be set to true. * If tracing provider that has explicit requirements on span creation (like SkyWalking),   this flag should be set to true. The default value is false for now for backward compatibility.\"\n        },\n        \"operation\": {\n          \"type\": \"string\",\n          \"description\": \"The operation name of the span which will be used for tracing. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``. This field will take precedence over and make following settings ineffective: * :ref:`route decorator ` and * :ref:`x-envoy-decorator-operation `   header will be ignored.\"\n        },\n        \"upstream_operation\": {\n          \"type\": \"string\",\n          \"description\": \"The operation name of the upstream span which will be used for tracing. This only takes effect when ``spawn_upstream_span`` is set to true and the upstream span is created. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``.\"\n        },\n        \"no_context_propagation\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, trace context propagation is disabled, meaning that trace context headers (e.g. ``traceparent``, ``tracestate`` for OpenTelemetry/W3C, or ``X-B3-*`` headers for Zipkin) will not be injected when proxying requests to upstreams. This is useful for scenarios where you want to report spans from a proxy (e.g., an egress gateway) while preventing trace context from being propagated to external services, effectively stopping the trace at the mesh boundary. Note that span reporting is still performed when this is set to true - only context propagation is disabled. Default: false (context propagation is enabled)\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Tracing\",\n      \"description\": \"[#next-free-field: 14]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig\": {\n      \"properties\": {\n        \"upgrade_type\": {\n          \"type\": \"string\",\n          \"description\": \"The case-insensitive name of this upgrade, e.g. \\\"websocket\\\". For each upgrade type present in upgrade_configs, requests with Upgrade: [upgrade_type] will be proxied upstream.\"\n        },\n        \"filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"If present, this represents the filter chain which will be created for this type of upgrade. If no filters are present, the filter chain for HTTP connections will be used for this upgrade type.\"\n        },\n        \"enabled\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Determines if upgrades are enabled or disabled by default. Defaults to true. This can be overridden on a per-route basis with :ref:`cluster ` as documented in the :ref:`upgrade documentation `.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Upgrade Config\",\n      \"description\": \"The configuration for HTTP upgrades. For each upgrade type desired, an UpgradeConfig must be added. .. warning::    The current implementation of upgrade headers does not handle multi-valued upgrade headers. Support for    multi-valued headers may be added in the future if needed. .. warning::    The current implementation of upgrade headers does not work with HTTP/2 upstreams.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the filter configuration. It also serves as a resource name in ExtensionConfigDS.\"\n        },\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        },\n        \"config_discovery\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ExtensionConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for an extension configuration discovery service. In case of a failure and without the default configuration, the HTTP listener responds with code 500. Extension configs delivered through this mechanism are not expected to require warming (see https://github.com/envoyproxy/envoy/issues/12061). To support configuring a :ref:`match tree `, use an :ref:`ExtensionWithMatcher ` with the desired HTTP filter. This works for both the default filter configuration as well as for filters provided via the API.\"\n        },\n        \"is_optional\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, clients that do not support this filter may ignore the filter but otherwise accept the config. Otherwise, clients that do not support this filter must reject the config.\"\n        },\n        \"disabled\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the filter is disabled by default and must be explicitly enabled by setting per filter configuration in the route configuration. See :ref:`route based filter chain ` for more details. Terminal filters (e.g. ``envoy.filters.http.router``) cannot be marked as disabled.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http Filter\",\n      \"description\": \"[#next-free-field: 8]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig\": {\n      \"properties\": {\n        \"mappers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration of list of mappers which allows to filter and change local response. The mappers will be checked by the specified order until one is matched.\"\n        },\n        \"body_format\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SubstitutionFormatString\",\n          \"additionalProperties\": false,\n          \"description\": \"The configuration to form response body from the :ref:`command operators ` and to specify response content type as one of: plain/text or application/json. Example one: \\\"plain/text\\\" ``body_format``. .. validated-code-block:: yaml   :type-name: envoy.config.core.v3.SubstitutionFormatString   text_format: \\\"%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\\\\n\\\" The following response body in \\\"plain/text\\\" format will be generated for a request with local reply body of \\\"upstream connection error\\\", response_code=503 and path=/foo. .. code-block:: text   upstream connect error:503:path=/foo Example two: \\\"application/json\\\" ``body_format``. .. validated-code-block:: yaml   :type-name: envoy.config.core.v3.SubstitutionFormatString   json_format:     status: \\\"%RESPONSE_CODE%\\\"     message: \\\"%LOCAL_REPLY_BODY%\\\"     path: \\\"%REQ(:path)%\\\" The following response body in \\\"application/json\\\" format would be generated for a request with local reply body of \\\"upstream connection error\\\", response_code=503 and path=/foo. .. code-block:: json  {    \\\"status\\\": 503,    \\\"message\\\": \\\"upstream connection error\\\",    \\\"path\\\": \\\"/foo\\\"  }\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Local Reply Config\",\n      \"description\": \"The configuration to customize local reply returned by Envoy.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.Rds\": {\n      \"properties\": {\n        \"config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for RDS.\"\n        },\n        \"route_config_name\": {\n          \"type\": \"string\",\n          \"description\": \"The name of the route configuration. This name will be passed to the RDS API. This allows an Envoy configuration with multiple HTTP listeners (and associated HTTP connection manager filters) to use different route configurations.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Rds\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension\": {\n      \"properties\": {\n        \"typed_config\": {\n          \"type\": \"object\",\n          \"required\": [\n            \"@type\"\n          ],\n          \"properties\": {\n            \"@type\": {\n              \"type\": \"string\",\n              \"examples\": [\n                \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\n                \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\",\n                \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\",\n                \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\",\n                \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\",\n                \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\n                \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n              ]\n            }\n          },\n          \"allOf\": [\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpConnectionManager\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/GrpcJsonTranscoder\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Router\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/JwtAuthentication\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/Cors\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/HttpProtocolOptions\"\n              }\n            },\n            {\n              \"if\": {\n                \"properties\": {\n                  \"@type\": {\n                    \"const\": \"type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\"\n                  }\n                }\n              },\n              \"then\": {\n                \"$ref\": \"#/definitions/StdoutAccessLog\"\n              }\n            }\n          ]\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Request ID Extension\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper\": {\n      \"properties\": {\n        \"filter\": {\n          \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLogFilter\",\n          \"additionalProperties\": false,\n          \"description\": \"Filter to determine if this mapper should apply.\"\n        },\n        \"status_code\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The new response status code if specified.\"\n        },\n        \"body\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"The new local reply body text if specified. It will be used in the ``%LOCAL_REPLY_BODY%`` command operator in the ``body_format``.\"\n        },\n        \"body_format_override\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SubstitutionFormatString\",\n          \"additionalProperties\": false,\n          \"description\": \"A per mapper ``body_format`` to override the :ref:`body_format `. It will be used when this mapper is matched.\"\n        },\n        \"headers_to_add\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.HeaderValueOption\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"HTTP headers to add to a local reply. This allows the response mapper to append, to add or to override headers of any local reply before it is sent to a downstream client.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Response Mapper\",\n      \"description\": \"The configuration to filter and change local response. [#next-free-field: 6]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds\": {\n      \"properties\": {\n        \"scoped_rds_config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for scoped RDS.\"\n        },\n        \"srds_resources_locator\": {\n          \"type\": \"string\",\n          \"description\": \"xdstp:// resource locator for scoped RDS collection. [#not-implemented-hide:]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Scoped Rds\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList\": {\n      \"properties\": {\n        \"scoped_route_configurations\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.ScopedRouteConfiguration\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Scoped Route Configurations List\",\n      \"description\": \"This message is used to work around the limitations with 'oneof' and repeated fields.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name assigned to the scoped routing configuration.\"\n        },\n        \"scope_key_builder\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder\",\n          \"additionalProperties\": false,\n          \"description\": \"The algorithm to use for constructing a scope key for each request.\"\n        },\n        \"rds_config_source\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.ConfigSource\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration source specifier for RDS. This config source is used to subscribe to RouteConfiguration resources specified in ScopedRouteConfiguration messages.\"\n        },\n        \"scoped_route_configurations_list\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList\",\n          \"additionalProperties\": false,\n          \"description\": \"The set of routing scopes corresponding to the HCM. A scope is assigned to a request by matching a key constructed from the request's attributes according to the algorithm specified by the :ref:`ScopeKeyBuilder` in this message.\"\n        },\n        \"scoped_rds\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds\",\n          \"additionalProperties\": false,\n          \"description\": \"The set of routing scopes associated with the HCM will be dynamically loaded via the SRDS API. A scope is assigned to a request by matching a key constructed from the request's attributes according to the algorithm specified by the :ref:`ScopeKeyBuilder` in this message.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Scoped Routes\",\n      \"description\": \"[#next-free-field: 6]\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder\": {\n      \"properties\": {\n        \"fragments\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The final(built) scope key consists of the ordered union of these fragments, which are compared in order with the fragments of a :ref:`ScopedRouteConfiguration`. A missing fragment during comparison will make the key invalid, i.e., the computed key doesn't match any key.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Scope Key Builder\",\n      \"description\": \"Specifies the mechanism for constructing \\\"scope keys\\\" based on HTTP request attributes. These keys are matched against a set of :ref:`Key` objects assembled from :ref:`ScopedRouteConfiguration` messages distributed via SRDS (the Scoped Route Discovery Service) or assigned statically via :ref:`scoped_route_configurations_list`. Upon receiving a request's headers, the Router will build a key using the algorithm specified by this message. This key will be used to look up the routing table (i.e., the :ref:`RouteConfiguration`) to use for the request.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder\": {\n      \"properties\": {\n        \"header_value_extractor\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies how a header field's value should be extracted.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Fragment Builder\",\n      \"description\": \"Specifies the mechanism for constructing key fragments which are composed into scope keys.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the header field to extract the value from. .. note::   If the header appears multiple times only the first value is used.\"\n        },\n        \"element_separator\": {\n          \"type\": \"string\",\n          \"description\": \"The element separator (e.g., ';' separates 'a;b;c;d'). Default: empty string. This causes the entirety of the header field to be extracted. If this field is set to an empty string and 'index' is used in the oneof below, 'index' must be set to 0.\"\n        },\n        \"index\": {\n          \"type\": \"integer\",\n          \"description\": \"Specifies the zero based index of the element to extract. Note Envoy concatenates multiple values of the same header key into a comma separated string, the splitting always happens after the concatenation.\"\n        },\n        \"element\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the key value pair to extract the value from.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header Value Extractor\",\n      \"description\": \"Specifies how the value of a header should be extracted. The following example maps the structure of a header to the fields in this message. .. code::              <0> <1>   <-- index    X-Header: a=b;c=d    |         || |    |         || \\\\---->     |         ||    |         |\\\\---->     |         |    |         \\\\---->     |    \\\\---->     Each 'a=b' key-value pair constitutes an 'element' of the header field.\"\n    },\n    \"envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement\": {\n      \"properties\": {\n        \"separator\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The separator between key and value (e.g., '=' separates 'k=v;...'). If an element is an empty string, the element is ignored. If an element contains no separator, the whole element is parsed as key and the fragment value is an empty string. If there are multiple values for a matched key, the first value is returned.\"\n        },\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The key to match on.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Kv Element\",\n      \"description\": \"Specifies a header field's key value pair to match on.\"\n    },\n    \"envoy.type.http.v3.PathTransformation\": {\n      \"properties\": {\n        \"operations\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.type.http.v3.PathTransformation.Operation\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"A list of operations to apply. Transformations will be performed in the order that they appear.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"PathTransformation defines an API to apply a sequence of operations that can be used to alter\\n text before it is used for matching or routing. Multiple actions can be applied in the same\\n Transformation, forming a sequential pipeline. The transformations will be performed in the order\\n that they appear.\\n\\n This API is a work in progress.\",\n      \"description\": \"[#protodoc-title: Path Transformations API]  PathTransformation defines an API to apply a sequence of operations that can be used to alter text before it is used for matching or routing. Multiple actions can be applied in the same Transformation, forming a sequential pipeline. The transformations will be performed in the order that they appear. This API is a work in progress.\"\n    },\n    \"envoy.type.http.v3.PathTransformation.Operation\": {\n      \"properties\": {\n        \"normalize_path_rfc_3986\": {\n          \"$ref\": \"#/definitions/envoy.type.http.v3.PathTransformation.Operation.NormalizePathRFC3986\",\n          \"additionalProperties\": false,\n          \"description\": \"Enable path normalization per RFC 3986.\"\n        },\n        \"merge_slashes\": {\n          \"$ref\": \"#/definitions/envoy.type.http.v3.PathTransformation.Operation.MergeSlashes\",\n          \"additionalProperties\": false,\n          \"description\": \"Enable merging adjacent slashes.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Operation\",\n      \"description\": \"A type of operation to alter text.\"\n    },\n    \"envoy.type.http.v3.PathTransformation.Operation.MergeSlashes\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Merge Slashes\",\n      \"description\": \"Determines if adjacent slashes are merged into one. A common use case is for a request path header. Using this option in ``:ref: PathNormalizationOptions `` will allow incoming requests with path ``//dir///file`` to match against route with ``prefix`` match set to ``/dir``. When using for header transformations, note that slash merging is not part of `HTTP spec `_ and is provided for convenience.\"\n    },\n    \"envoy.type.http.v3.PathTransformation.Operation.NormalizePathRFC3986\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Normalize Path RFC 3986\",\n      \"description\": \"Should text be normalized according to RFC 3986? This typically is used for path headers before any processing of requests by HTTP filters or routing. This applies percent-encoded normalization and path segment normalization. Fails on characters disallowed in URLs (e.g. NULLs). See `Normalization and Comparison `_ for details of normalization. Note that this options does not perform `case normalization `_\"\n    },\n    \"envoy.type.matcher.v3.AddressMatcher\": {\n      \"properties\": {\n        \"ranges\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/xds.core.v3.CidrRange\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\"\n        },\n        \"invert_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"If true, the match result will be inverted. Defaults to false. * If set to false (default), the matcher will return true if the IP matches any of the CIDR ranges. * If set to true, the matcher will return true if the IP does NOT match any of the CIDR ranges.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Address Matcher]\",\n      \"description\": \"[#protodoc-title: Address Matcher]  Match an IP against a repeated CIDR range. This matcher is intended to be used in other matchers, for example in the filter state matcher to match a filter state object as an IP.\"\n    },\n    \"envoy.type.matcher.v3.FilterStateMatcher\": {\n      \"properties\": {\n        \"key\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The filter state key to retrieve the object.\"\n        },\n        \"string_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Matches the filter state object as a string value.\"\n        },\n        \"address_match\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.AddressMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Matches the filter state object as a ip Instance.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Filter state matcher]\",\n      \"description\": \"[#protodoc-title: Filter state matcher]  FilterStateMatcher provides a general interface for matching the filter state objects.\"\n    },\n    \"envoy.type.matcher.v3.RegexMatchAndSubstitute\": {\n      \"properties\": {\n        \"pattern\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.RegexMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"The regular expression used to find portions of a string (hereafter called the \\\"subject string\\\") that should be replaced. When a new string is produced during the substitution operation, the new string is initially the same as the subject string, but then all matches in the subject string are replaced by the substitution string. If replacing all matches isn't desired, regular expression anchors can be used to ensure a single match, so as to replace just one occurrence of a pattern. Capture groups can be used in the pattern to extract portions of the subject string, and then referenced in the substitution string.\"\n        },\n        \"substitution\": {\n          \"type\": \"string\",\n          \"description\": \"The string that should be substituted into matching portions of the subject string during a substitution operation to produce a new string. Capture groups in the pattern can be referenced in the substitution string. Note, however, that the syntax for referring to capture groups is defined by the chosen regular expression engine. Google's `RE2 `_ regular expression engine uses a backslash followed by the capture group number to denote a numbered capture group. E.g., ``\\\\1`` refers to capture group 1, and ``\\\\2`` refers to capture group 2.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Regex Match And Substitute\",\n      \"description\": \"Describes how to match a string and then produce a new string using a regular expression and a substitution string.\"\n    },\n    \"envoy.type.metadata.v3.MetadataKind\": {\n      \"properties\": {\n        \"request\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKind.Request\",\n          \"additionalProperties\": false,\n          \"description\": \"Request kind of metadata.\"\n        },\n        \"route\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKind.Route\",\n          \"additionalProperties\": false,\n          \"description\": \"Route kind of metadata.\"\n        },\n        \"cluster\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKind.Cluster\",\n          \"additionalProperties\": false,\n          \"description\": \"Cluster kind of metadata.\"\n        },\n        \"host\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKind.Host\",\n          \"additionalProperties\": false,\n          \"description\": \"Host kind of metadata.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Metadata Kind\",\n      \"description\": \"Describes different types of metadata sources.\"\n    },\n    \"envoy.type.metadata.v3.MetadataKind.Cluster\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cluster\",\n      \"description\": \"Represents metadata from :ref:`the upstream cluster`.\"\n    },\n    \"envoy.type.metadata.v3.MetadataKind.Host\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Host\",\n      \"description\": \"Represents metadata from :ref:`the upstream host`.\"\n    },\n    \"envoy.type.metadata.v3.MetadataKind.Request\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Request\",\n      \"description\": \"Represents dynamic metadata associated with the request.\"\n    },\n    \"envoy.type.metadata.v3.MetadataKind.Route\": {\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Route\",\n      \"description\": \"Represents metadata from :ref:`the route`.\"\n    },\n    \"envoy.type.tracing.v3.CustomTag\": {\n      \"properties\": {\n        \"tag\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Used to populate the tag name.\"\n        },\n        \"literal\": {\n          \"$ref\": \"#/definitions/envoy.type.tracing.v3.CustomTag.Literal\",\n          \"additionalProperties\": false,\n          \"description\": \"A literal custom tag.\"\n        },\n        \"environment\": {\n          \"$ref\": \"#/definitions/envoy.type.tracing.v3.CustomTag.Environment\",\n          \"additionalProperties\": false,\n          \"description\": \"An environment custom tag.\"\n        },\n        \"request_header\": {\n          \"$ref\": \"#/definitions/envoy.type.tracing.v3.CustomTag.Header\",\n          \"additionalProperties\": false,\n          \"description\": \"A request header custom tag.\"\n        },\n        \"metadata\": {\n          \"$ref\": \"#/definitions/envoy.type.tracing.v3.CustomTag.Metadata\",\n          \"additionalProperties\": false,\n          \"description\": \"A custom tag to obtain tag value from the metadata.\"\n        },\n        \"value\": {\n          \"type\": \"string\",\n          \"description\": \"Custom tag value. The same :ref:`format specifier ` as used for :ref:`HTTP access logging ` applies here, however unknown specifier values are replaced with the empty string instead of ``-``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Custom Tag]\",\n      \"description\": \"[#protodoc-title: Custom Tag]  Describes custom tags for the active span. [#next-free-field: 7]\"\n    },\n    \"envoy.type.tracing.v3.CustomTag.Environment\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Environment variable name to obtain the value to populate the tag value.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"When the environment variable is not found, the tag value will be populated with this default value if specified, otherwise no tag will be populated.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Environment\",\n      \"description\": \"Environment type custom tag with environment name and default value.\"\n    },\n    \"envoy.type.tracing.v3.CustomTag.Header\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Header name to obtain the value to populate the tag value.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"When the header does not exist, the tag value will be populated with this default value if specified, otherwise no tag will be populated.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Header\",\n      \"description\": \"Header type custom tag with header name and default value.\"\n    },\n    \"envoy.type.tracing.v3.CustomTag.Literal\": {\n      \"properties\": {\n        \"value\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Static literal value to populate the tag value.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Literal\",\n      \"description\": \"Literal type custom tag with static value for the tag value.\"\n    },\n    \"envoy.type.tracing.v3.CustomTag.Metadata\": {\n      \"properties\": {\n        \"kind\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKind\",\n          \"additionalProperties\": false,\n          \"description\": \"Specify what kind of metadata to obtain tag value from.\"\n        },\n        \"metadata_key\": {\n          \"$ref\": \"#/definitions/envoy.type.metadata.v3.MetadataKey\",\n          \"additionalProperties\": false,\n          \"description\": \"Metadata key to define the path to retrieve the tag value.\"\n        },\n        \"default_value\": {\n          \"type\": \"string\",\n          \"description\": \"When no valid metadata is found, the tag value would be populated with this default value if specified, otherwise no tag would be populated.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Metadata\",\n      \"description\": \"Metadata type custom tag using :ref:`MetadataKey ` to retrieve the protobuf value from :ref:`Metadata `, and populate the tag value with `the canonical JSON `_ representation of it.\"\n    },\n    \"xds.core.v3.CidrRange\": {\n      \"properties\": {\n        \"address_prefix\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"IPv4 or IPv6 address, e.g. ``192.0.0.0`` or ``2001:db8::``.\"\n        },\n        \"prefix_len\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"Length of prefix, e.g. 0, 32. Defaults to 0 when unset.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Cidr Range\",\n      \"description\": \"CidrRange specifies an IP Address and a prefix length to construct the subnet mask for a `CIDR `_ range.\"\n    },\n    \"HttpProtocolOptions\": {\n      \"properties\": {\n        \"common_http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HttpProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"This contains options common across HTTP/1 and HTTP/2\"\n        },\n        \"upstream_http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.UpstreamHttpProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"This contains common protocol options which are only applied upstream.\"\n        },\n        \"explicit_http_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.upstreams.http.v3.HttpProtocolOptions.ExplicitHttpConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"To explicitly configure either HTTP/1 or HTTP/2 (but not both!) use ``explicit_http_config``.\"\n        },\n        \"use_downstream_protocol_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.upstreams.http.v3.HttpProtocolOptions.UseDownstreamHttpConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"This allows switching on protocol based on what protocol the downstream connection used.\"\n        },\n        \"auto_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.upstreams.http.v3.HttpProtocolOptions.AutoHttpConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"This allows switching on protocol based on ALPN\"\n        },\n        \"http_filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Optional HTTP filters for the upstream HTTP filter chain. .. note::   Upstream HTTP filters are currently in alpha. These filters will be applied for all HTTP streams which flow through this cluster. Unlike downstream HTTP filters, they will *not* be applied to terminated CONNECT requests. If using upstream HTTP filters, please be aware that local errors sent by upstream HTTP filters will not trigger retries, and local errors sent by upstream HTTP filters will count as a final response if hedging is configured. [#extension-category: envoy.filters.http.upstream]\"\n        },\n        \"header_validation_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration options for Unified Header Validation (UHV). UHV is an extensible mechanism for checking validity of HTTP responses. [#comment:TODO(yanavlasov): Make it a link to the default header validator doc when it becomes visible.] Leaving this field unspecified, selects the default header validator ``envoy.http.header_validators.envoy_default``. [#not-implemented-hide:] [#extension-category: envoy.http.header_validators]\"\n        },\n        \"outlier_detection\": {\n          \"$ref\": \"#/definitions/envoy.extensions.upstreams.http.v3.HttpProtocolOptions.OutlierDetection\",\n          \"additionalProperties\": false,\n          \"description\": \"Defines http specific outlier detection parameters.\"\n        },\n        \"request_mirror_policies\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.RequestMirrorPolicy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP-level mirroring policies for requests routed to this cluster. Cluster-level policies override route-level policies when they both are configured. .. note::   Mirroring will not be triggered if the :ref:`primary cluster   ` does not exist.\"\n        },\n        \"hash_policy\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.RouteAction.HashPolicy\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of hash policies for consistent hashing load balancing (e.g., Ring Hash or Maglev) for requests routed to this cluster. When configured, cluster-level policies override route-level policies. When not configured, route-level policies (if any) will be used. This enables consistent routing to the same upstream host for all requests to a cluster, which is particularly useful for stateful services like caching, session management, or sticky routing requirements. .. note::   Hash policies are only effective when the cluster is configured with a hash-based load   balancing policy (e.g., :ref:`RING_HASH `   or :ref:`MAGLEV `).\"\n        },\n        \"retry_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RetryPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Specifies the retry policy for requests routed to this cluster. When configured, cluster-level retry policy overrides route-level retry policy. When not configured, route-level retry policy (if any) will be used. .. note::   Cluster-level retry policy will override route-level retry policy entirely. Policies are   not merged.\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: HTTP Protocol Options]\\n [#extension: envoy.upstreams.http.http_protocol_options]\",\n      \"description\": \"[#protodoc-title: HTTP Protocol Options] [#extension: envoy.upstreams.http.http_protocol_options]  HttpProtocolOptions specifies Http upstream protocol options. This object is used in :ref:`typed_extension_protocol_options`, keyed by the name ``envoy.extensions.upstreams.http.v3.HttpProtocolOptions``. This controls what protocol(s) should be used for upstream and how said protocol(s) are configured. This replaces the prior pattern of explicit protocol configuration directly in the cluster. So a configuration like this, explicitly configuring the use of HTTP/2 upstream: .. code::   clusters:     - name: some_service       connect_timeout: 5s       upstream_http_protocol_options:         auto_sni: true       common_http_protocol_options:         idle_timeout: 1s       http2_protocol_options:         max_concurrent_streams: 100        .... [further cluster config] Would now look like this: .. code::   clusters:     - name: some_service       connect_timeout: 5s       typed_extension_protocol_options:         envoy.extensions.upstreams.http.v3.HttpProtocolOptions:           \\\"@type\\\": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions           upstream_http_protocol_options:             auto_sni: true           common_http_protocol_options:             idle_timeout: 1s           explicit_http_config:             http2_protocol_options:               max_concurrent_streams: 100        .... [further cluster config] [#next-free-field: 12]\"\n    },\n    \"envoy.config.common.matcher.v3.HttpGenericBodyMatch\": {\n      \"properties\": {\n        \"bytes_limit\": {\n          \"type\": \"integer\",\n          \"description\": \"Limits search to specified number of bytes - default zero (no limit - match entire captured buffer).\"\n        },\n        \"patterns\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpGenericBodyMatch.GenericTextMatch\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"List of patterns to match.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http Generic Body Match\",\n      \"description\": \"HTTP generic body match configuration. List of text strings and hex strings to be located in HTTP body. All specified strings must be found in the HTTP body for positive match. The search may be limited to specified number of bytes from the body start. .. attention::   Searching for patterns in HTTP body is potentially CPU-intensive. For each specified pattern, HTTP body is scanned byte by byte to find a match.   If multiple patterns are specified, the process is repeated for each pattern. If location of a pattern is known, ``bytes_limit`` should be specified   to scan only part of the HTTP body.\"\n    },\n    \"envoy.config.common.matcher.v3.HttpGenericBodyMatch.GenericTextMatch\": {\n      \"properties\": {\n        \"string_match\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Text string to be located in HTTP body.\"\n        },\n        \"binary_match\": {\n          \"type\": \"string\",\n          \"description\": \"Sequence of bytes to be located in HTTP body.\",\n          \"format\": \"binary\",\n          \"binaryEncoding\": \"base64\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Generic Text Match\"\n    },\n    \"envoy.config.common.matcher.v3.HttpHeadersMatch\": {\n      \"properties\": {\n        \"headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.route.v3.HeaderMatcher\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"HTTP headers to match.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Http Headers Match\",\n      \"description\": \"HTTP headers match configuration.\"\n    },\n    \"envoy.config.common.matcher.v3.MatchPredicate\": {\n      \"properties\": {\n        \"or_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.MatchPredicate.MatchSet\",\n          \"additionalProperties\": false,\n          \"description\": \"A set that describes a logical OR. If any member of the set matches, the match configuration matches.\"\n        },\n        \"and_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.MatchPredicate.MatchSet\",\n          \"additionalProperties\": false,\n          \"description\": \"A set that describes a logical AND. If all members of the set match, the match configuration matches.\"\n        },\n        \"not_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.MatchPredicate\",\n          \"additionalProperties\": false,\n          \"description\": \"A negation match. The match configuration will match if the negated match condition matches.\"\n        },\n        \"any_match\": {\n          \"type\": \"boolean\",\n          \"description\": \"The match configuration will always match.\"\n        },\n        \"http_request_headers_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpHeadersMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP request headers match configuration.\"\n        },\n        \"http_request_trailers_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpHeadersMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP request trailers match configuration.\"\n        },\n        \"http_response_headers_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpHeadersMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP response headers match configuration.\"\n        },\n        \"http_response_trailers_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpHeadersMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP response trailers match configuration.\"\n        },\n        \"http_request_generic_body_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpGenericBodyMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP request generic body match configuration.\"\n        },\n        \"http_response_generic_body_match\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.HttpGenericBodyMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"HTTP response generic body match configuration.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Match Predicate\",\n      \"description\": \"Match configuration. This is a recursive structure which allows complex nested match configurations to be built using various logical operators. [#next-free-field: 11]\"\n    },\n    \"envoy.config.common.matcher.v3.MatchPredicate.MatchSet\": {\n      \"properties\": {\n        \"rules\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.MatchPredicate\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"The list of rules that make up the set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Match Set\",\n      \"description\": \"A set of match configurations used for logical operations.\"\n    },\n    \"envoy.config.core.v3.AlternateProtocolsCacheOptions\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The name of the cache. Multiple named caches allow independent alternate protocols cache configurations to operate within a single Envoy process using different configurations. All alternate protocols cache options with the same name *must* be equal in all fields when referenced from different configuration components. Configuration will fail to load if this is not the case.\"\n        },\n        \"max_entries\": {\n          \"additionalProperties\": false,\n          \"type\": \"integer\",\n          \"description\": \"The maximum number of entries that the cache will hold. If not specified defaults to ``1024``. .. note::   The implementation is approximate and enforced independently on each worker thread, thus   it is possible for the maximum entries in the cache to go slightly above the configured   value depending on timing. This is similar to how other circuit breakers work.\"\n        },\n        \"key_value_store_config\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.TypedExtensionConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Allows configuring a persistent :ref:`key value store ` to flush alternate protocols entries to disk. This function is currently only supported if concurrency is 1 Cached entries will take precedence over pre-populated entries below.\"\n        },\n        \"prepopulated_entries\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.core.v3.AlternateProtocolsCacheOptions.AlternateProtocolsCacheEntry\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Allows pre-populating the cache with entries, as described above.\"\n        },\n        \"canonical_suffixes\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Optional list of hostnames suffixes for which Alt-Svc entries can be shared. For example, if this list contained the value ``.c.example.com``, then an Alt-Svc entry for ``foo.c.example.com`` could be shared with ``bar.c.example.com`` but would not be shared with ``baz.example.com``. On the other hand, if the list contained the value ``.example.com`` then all three hosts could share Alt-Svc entries. Each entry must start with ``.``. If a hostname matches multiple suffixes, the first listed suffix will be used. Since lookup in this list is O(n), it is recommended that the number of suffixes be limited. [#not-implemented-hide:]\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Alternate Protocols Cache Options\",\n      \"description\": \"Configures the alternate protocols cache which tracks alternate protocols that can be used to make an HTTP connection to an origin server. See https://tools.ietf.org/html/rfc7838 for HTTP Alternative Services and https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-04 for the \\\"HTTPS\\\" DNS resource record. [#next-free-field: 6]\"\n    },\n    \"envoy.config.core.v3.AlternateProtocolsCacheOptions.AlternateProtocolsCacheEntry\": {\n      \"properties\": {\n        \"hostname\": {\n          \"type\": \"string\",\n          \"description\": \"The host name for the alternate protocol entry.\"\n        },\n        \"port\": {\n          \"type\": \"integer\",\n          \"description\": \"The port for the alternate protocol entry.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Alternate Protocols Cache Entry\",\n      \"description\": \"Allows pre-populating the cache with HTTP/3 alternate protocols entries with a 7 day lifetime. This will cause Envoy to attempt HTTP/3 to those upstreams, even if the upstreams have not advertised HTTP/3 support. These entries will be overwritten by alt-svc response headers or cached values. As with regular cached entries, if the origin response would result in clearing an existing alternate protocol cache entry, pre-populated entries will also be cleared. Adding a cache entry with hostname=foo.com port=123 is the equivalent of getting response headers alt-svc: h3=:\\\"123\\\"; ma=86400\\\" in a response to a request to foo.com:123\"\n    },\n    \"envoy.extensions.upstreams.http.v3.HttpProtocolOptions.AutoHttpConfig\": {\n      \"properties\": {\n        \"http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"http2_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http2ProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"http3_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http3ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Unlike HTTP/1 and HTTP/2, HTTP/3 will not be configured unless it is present, and (soon) only if there is an indication of server side support. See :ref:`here ` for more information on when HTTP/3 will be used, and when Envoy will fail over to TCP. .. warning::   QUIC upstream support is currently not ready for internet use.   Please see :ref:`here ` for details.\"\n        },\n        \"alternate_protocols_cache_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.AlternateProtocolsCacheOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"The presence of alternate protocols cache options causes the use of the alternate protocols cache, which is responsible for parsing and caching HTTP Alt-Svc headers. This enables the use of HTTP/3 for origins that advertise supporting it. .. note::   This is required when HTTP/3 is enabled.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Auto Http Config\",\n      \"description\": \"If this is used, the cluster can use either HTTP/1 or HTTP/2, and will use whichever protocol is negotiated by ALPN with the upstream. Clusters configured with ``AutoHttpConfig`` will use the highest available protocol; HTTP/2 if supported, otherwise HTTP/1. If the upstream does not support ALPN, ``AutoHttpConfig`` will fail over to HTTP/1. This can only be used with transport sockets which support ALPN. Using a transport socket which does not support ALPN will result in configuration failure. The transport layer may be configured with custom ALPN, but the default ALPN for the cluster (or if custom ALPN fails) will be \\\"h2,http/1.1\\\".\"\n    },\n    \"envoy.extensions.upstreams.http.v3.HttpProtocolOptions.ExplicitHttpConfig\": {\n      \"properties\": {\n        \"http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"http2_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http2ProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"http3_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http3ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \".. warning::   QUIC upstream support is currently not ready for internet use.   Please see :ref:`here ` for details.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Explicit Http Config\",\n      \"description\": \"If this is used, the cluster will only operate on one of the possible upstream protocols. Note that HTTP/2 or above should generally be used for upstream gRPC clusters.\"\n    },\n    \"envoy.extensions.upstreams.http.v3.HttpProtocolOptions.OutlierDetection\": {\n      \"properties\": {\n        \"error_matcher\": {\n          \"$ref\": \"#/definitions/envoy.config.common.matcher.v3.MatchPredicate\",\n          \"additionalProperties\": false,\n          \"description\": \"If specified, only responses matching the matcher will be treated by outlier detection as errors. If not specified, only 5xx codes are treated by outlier detection as errors.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Outlier Detection\"\n    },\n    \"envoy.extensions.upstreams.http.v3.HttpProtocolOptions.UseDownstreamHttpConfig\": {\n      \"properties\": {\n        \"http_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http1ProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"http2_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http2ProtocolOptions\",\n          \"additionalProperties\": false\n        },\n        \"http3_protocol_options\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.Http3ProtocolOptions\",\n          \"additionalProperties\": false,\n          \"description\": \".. warning::   QUIC upstream support is currently not ready for internet use.   Please see :ref:`here ` for details.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Use Downstream Http Config\",\n      \"description\": \"If this is used, the cluster can use either of the configured protocols, and will use whichever protocol was used by the downstream connection. If HTTP/3 is configured for downstream and not configured for upstream, HTTP/3 requests will fail over to HTTP/2.\"\n    },\n    \"JwtAuthentication\": {\n      \"properties\": {\n        \"providers\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtProvider\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"Map of provider names to JwtProviders. .. code-block:: yaml   providers:     provider1:        issuer: issuer1        audiences:        - audience1        - audience2        remote_jwks:          http_uri:            uri: https://example.com/.well-known/jwks.json            cluster: example_jwks_cluster            timeout: 1s      provider2:        issuer: provider2        local_jwks:          inline_string: jwks_string\"\n        },\n        \"rules\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.RequirementRule\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specifies requirements based on the route matches. The first matched requirement will be applied. If there are overlapped match conditions, please put the most specific match first. Examples .. code-block:: yaml   rules:     - match:         prefix: /healthz     - match:         prefix: /baz       requires:         provider_name: provider1     - match:         prefix: /foo       requires:         requires_any:           requirements:             - provider_name: provider1             - provider_name: provider2     - match:         prefix: /bar       requires:         requires_all:           requirements:             - provider_name: provider1             - provider_name: provider2\"\n        },\n        \"filter_state_rules\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.FilterStateRule\",\n          \"additionalProperties\": false,\n          \"description\": \"This message specifies Jwt requirements based on stream_info.filterState. Other HTTP filters can use it to specify Jwt requirements dynamically. The ``rules`` field above is checked first, if it could not find any matches, check this one.\"\n        },\n        \"bypass_cors_preflight\": {\n          \"type\": \"boolean\",\n          \"description\": \"When set to true, bypass the `CORS preflight request `_ regardless of JWT requirements specified in the rules.\"\n        },\n        \"requirement_map\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"A map of unique requirement_names to JwtRequirements. :ref:`requirement_name ` in ``PerRouteConfig`` uses this map to specify a JwtRequirement.\"\n        },\n        \"strip_failure_response\": {\n          \"type\": \"boolean\",\n          \"description\": \"A request failing the verification process will receive a 401 downstream with the failure response details in the body along with WWWAuthenticate header value set with \\\"invalid token\\\". If this value is set to true, the response details will be stripped and only a 401 response code will be returned. Default value is false\"\n        },\n        \"stat_prefix\": {\n          \"type\": \"string\",\n          \"description\": \"Optional additional prefix to use when emitting statistics.\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Authentication\",\n      \"description\": \"This is the Envoy HTTP filter config for JWT authentication. For example: .. code-block:: yaml   providers:      provider1:        issuer: issuer1        audiences:        - audience1        - audience2        remote_jwks:          http_uri:            uri: https://example.com/.well-known/jwks.json            cluster: example_jwks_cluster            timeout: 1s      provider2:        issuer: issuer2        local_jwks:          inline_string: jwks_string   rules:      # Not jwt verification is required for /health path      - match:          prefix: /health      # Jwt verification for provider1 is required for path prefixed with \\\"prefix\\\"      - match:          prefix: /prefix        requires:          provider_name: provider1      # Jwt verification for either provider1 or provider2 is required for all other requests.      - match:          prefix: /        requires:          requires_any:            requirements:              - provider_name: provider1              - provider_name: provider2 [#next-free-field: 8]\"\n    },\n    \"envoy.config.core.v3.HttpUri\": {\n      \"properties\": {\n        \"uri\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The HTTP server URI. It should be a full FQDN with protocol, host and path. Example: .. code-block:: yaml    uri: https://www.googleapis.com/oauth2/v1/certs\"\n        },\n        \"cluster\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"A cluster is created in the Envoy \\\"cluster_manager\\\" config section. This field specifies the cluster name. Example: .. code-block:: yaml    cluster: jwks_cluster\"\n        },\n        \"timeout\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Sets the maximum duration in milliseconds that a response can take to arrive upon request.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: HTTP service URI ]\",\n      \"description\": \"[#protodoc-title: HTTP service URI ]  Envoy external URI descriptor\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.ExtractOnlyWithoutValidation\": {\n      \"properties\": {\n        \"verification_status_header\": {\n          \"type\": \"string\",\n          \"description\": \"Name of the HTTP header set to \\\"false\\\" when a JWT is present but fails signature verification. The header is NOT set when: - The JWT is valid (verification succeeded), or - No JWT is present in the request. This means the header's presence is a meaningful signal to downstream filters: if set, the JWT was present but could not be verified, and any extracted claim headers should not be trusted for authorization. Downstream filters (RBAC, ext_authz) SHOULD check for the absence of this header (or its non-\\\"false\\\" value) before trusting JWT-derived claim headers for authorization decisions. Default (unset or empty): ``x-jwt-signature-verified``. Custom value: uses the specified header name. The header-setting behavior is guarded by the ``envoy.reloadable_features.jwt_authn_add_verification_status_header`` runtime flag (default on). If removal is needed downstream, use header mutation in a subsequent filter. Example: when a JWT is present in the request but fails signature verification, the request will carry: .. code-block:: yaml    x-jwt-signature-verified: false\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Extract Only Without Validation\",\n      \"description\": \"Configuration for extract-only mode without JWT signature validation. When this mode is active and a JWT is present in the request but fails signature verification, a verification status header is set on the request to signal to downstream filters (RBAC, ext_authz) that the JWT claims were NOT cryptographically verified. The header is not set when the JWT is valid or when no JWT is present.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.FilterStateRule\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The filter state name to retrieve the ``Router::StringAccessor`` object.\"\n        },\n        \"requires\": {\n          \"additionalProperties\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement\",\n            \"additionalProperties\": false\n          },\n          \"type\": \"object\",\n          \"description\": \"A map of string keys to requirements. The string key is the string value in the FilterState with the name specified in the ``name`` field above.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Filter State Rule\",\n      \"description\": \"This message specifies Jwt requirements based on stream_info.filterState. This FilterState should use ``Router::StringAccessor`` object to set a string value. Other HTTP filters can use it to specify Jwt requirements dynamically. Example: .. code-block:: yaml    name: jwt_selector    requires:      issuer_1:        provider_name: issuer1      issuer_2:        provider_name: issuer2 If a filter set \\\"jwt_selector\\\" with \\\"issuer_1\\\" to FilterState for a request, jwt_authn filter will use JwtRequirement{\\\"provider_name\\\": \\\"issuer1\\\"} to verify.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwksAsyncFetch\": {\n      \"properties\": {\n        \"fast_listener\": {\n          \"type\": \"boolean\",\n          \"description\": \"If false, the listener is activated after the initial fetch is completed. The initial fetch result can be either successful or failed. If true, it is activated without waiting for the initial fetch to complete. Default is false.\"\n        },\n        \"failed_refetch_duration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The duration to refetch after a failed fetch. If not specified, default is 1 second.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwks Async Fetch\",\n      \"description\": \"Fetch Jwks asynchronously in the main thread when the filter config is parsed. The listener is activated only after the Jwks is fetched. When the Jwks is expired in the cache, it is fetched again in the main thread. The fetched Jwks from the main thread can be used by all worker threads.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtCacheConfig\": {\n      \"properties\": {\n        \"jwt_cache_size\": {\n          \"type\": \"integer\",\n          \"description\": \"The unit is number of JWTs, default to 100.\"\n        },\n        \"jwt_max_token_size\": {\n          \"type\": \"integer\",\n          \"description\": \"The maximum size of a single cached token in bytes. If this field is not set or is set to 0, then the default value 4096 bytes is used. The maximum value for a token is inclusive.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Cache Config\",\n      \"description\": \"This message specifies JWT Cache configuration.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtClaimToHeader\": {\n      \"properties\": {\n        \"header_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The HTTP header name to copy the claim to. The header name will be sanitized and replaced.\"\n        },\n        \"claim_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The field name for the JWT Claim : it can be a nested claim of type (eg. \\\"claim.nested.key\\\", \\\"sub\\\") String separated with \\\".\\\" in case of nested claims. The nested claim name must use dot \\\".\\\" to separate the JSON name path.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Claim To Header\",\n      \"description\": \"This message specifies a combination of header name and claim name.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtHeader\": {\n      \"properties\": {\n        \"name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"The HTTP header name.\"\n        },\n        \"value_prefix\": {\n          \"type\": \"string\",\n          \"description\": \"The value prefix. The value format is \\\"value_prefix\\\" For example, for \\\"Authorization: Bearer \\\", value_prefix=\\\"Bearer \\\" with a space at the end.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Header\",\n      \"description\": \"This message specifies a header location to extract the JWT.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtProvider\": {\n      \"properties\": {\n        \"issuer\": {\n          \"type\": \"string\",\n          \"description\": \"Specify the `principal `_ that issued the JWT, usually a URL or an email address. It is optional. If specified, it has to match the ``iss`` field in JWT, otherwise the JWT ``iss`` field is not checked. .. note::     ``JwtRequirement`` :ref:`allow_missing `     and :ref:`allow_missing_or_failed `     are implemented differently than other ``JwtRequirements``. Hence the usage of this field     is different as follows if ``allow_missing`` or ``allow_missing_or_failed`` is used:     * If a JWT has ``iss`` field, it needs to be specified by this field in one of ``JwtProviders``.     * If a JWT doesn't have ``iss`` field, one of ``JwtProviders`` should fill this field empty.     * Multiple ``JwtProviders`` should not have same value in this field. Examples: * https://securetoken.google.com * Example: 1234567-compute@developer.gserviceaccount.com\"\n        },\n        \"audiences\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"The list of JWT `audiences `_ are allowed to access. A JWT containing any of these audiences will be accepted. If not specified, will not check audiences in the token. Example: .. code-block:: yaml     audiences:     - bookstore_android.apps.googleusercontent.com     - bookstore_web.apps.googleusercontent.com\"\n        },\n        \"subjects\": {\n          \"$ref\": \"#/definitions/envoy.type.matcher.v3.StringMatcher\",\n          \"additionalProperties\": false,\n          \"description\": \"Restrict the `subjects `_ that the JwtProvider can assert. For instance, this could implement JWT-SVID `subject restrictions `_. If not specified, will not check subjects in the token. Example: .. code-block:: yaml     subjects:       prefix: spiffe://spiffe.example.com/\"\n        },\n        \"require_expiration\": {\n          \"type\": \"boolean\",\n          \"description\": \"Requires that the credential contains an `expiration `_. For instance, this could implement JWT-SVID `expiration restrictions `_. Unlike ``max_lifetime``, this only requires that expiration is present, where ``max_lifetime`` also checks the value. Example: .. code-block:: yaml     require_expiration: true\"\n        },\n        \"max_lifetime\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Restrict the maximum remaining lifetime of a credential from the JwtProvider. Credential lifetime is the difference between the current time and the expiration of the credential. For instance, the following example will reject credentials that have a lifetime longer than 24 hours. If not set, expiration checking still occurs, but there is no limit on credential lifetime. If set, takes precedence over ``require_expiration``. Example: .. code-block:: yaml     max_lifetime:       seconds: 86400\",\n          \"format\": \"regex\"\n        },\n        \"remote_jwks\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.RemoteJwks\",\n          \"additionalProperties\": false,\n          \"description\": \"JWKS can be fetched from remote server via HTTP/HTTPS. This field specifies the remote HTTP URI and how the fetched JWKS should be cached. Example: .. code-block:: yaml    remote_jwks:      http_uri:        uri: https://www.googleapis.com/oauth2/v1/certs        cluster: jwt.www.googleapis.com|443        timeout: 1s      cache_duration:        seconds: 300\"\n        },\n        \"local_jwks\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.DataSource\",\n          \"additionalProperties\": false,\n          \"description\": \"JWKS is in local data source. It could be either in a local file or embedded in the inline_string. Example: local file .. code-block:: yaml    local_jwks:      filename: /etc/envoy/jwks/jwks1.txt Example: inline_string .. code-block:: yaml    local_jwks:      inline_string: ACADADADADA\"\n        },\n        \"forward\": {\n          \"type\": \"boolean\",\n          \"description\": \"If false, the JWT is removed in the request after a success verification. If true, the JWT is not removed in the request. Default value is false. caveat: only works for from_header/from_params & has no effect for JWTs extracted through from_cookies.\"\n        },\n        \"from_headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtHeader\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Two fields below define where to extract the JWT from an HTTP request. If no explicit location is specified, the following default locations are tried in order: 1. The Authorization header using the `Bearer schema `_. Example::    Authorization: Bearer . 2. `access_token `_ query parameter. Multiple JWTs can be verified for a request. Each JWT has to be extracted from the locations its provider specified or from the default locations. Specify the HTTP headers to extract the JWT. For examples, following config: .. code-block:: yaml   from_headers:   - name: x-goog-iap-jwt-assertion can be used to extract token from header::   ``x-goog-iap-jwt-assertion: ``.\"\n        },\n        \"from_params\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"JWT is sent in a query parameter. ``jwt_params`` represents the query parameter names. For example, if config is: .. code-block:: yaml   from_params:   - jwt_token The JWT format in query parameter is::    /path?jwt_token=\"\n        },\n        \"from_cookies\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"JWT is sent in a cookie. ``from_cookies`` represents the cookie names to extract from. For example, if config is: .. code-block:: yaml   from_cookies:   - auth-token Then JWT will be extracted from ``auth-token`` cookie in the request.\"\n        },\n        \"forward_payload_header\": {\n          \"type\": \"string\",\n          \"description\": \"This field specifies the header name to forward a successfully verified JWT payload to the backend. The forwarded data is::    base64url_encoded(jwt_payload_in_JSON) If it is not specified, the payload will not be forwarded.\"\n        },\n        \"pad_forward_payload_header\": {\n          \"type\": \"boolean\",\n          \"description\": \"When :ref:`forward_payload_header ` is specified, the base64 encoded payload will be added to the headers. Normally JWT based64 encode doesn't add padding. If this field is true, the header will be padded. This field is only relevant if :ref:`forward_payload_header ` is specified.\"\n        },\n        \"payload_in_metadata\": {\n          \"type\": \"string\",\n          \"description\": \"If non empty, successfully verified JWT payloads will be written to StreamInfo DynamicMetadata in the format as: ``namespace`` is the jwt_authn filter name as ````envoy.filters.http.jwt_authn```` The value is the ``protobuf::Struct``. The value of this field will be the key for its ``fields`` and the value is the ``protobuf::Struct`` converted from JWT JSON payload. For example, if payload_in_metadata is ``my_payload``: .. code-block:: yaml   envoy.filters.http.jwt_authn:     my_payload:       iss: https://example.com       sub: test@example.com       aud: https://example.com       exp: 1501281058\"\n        },\n        \"normalize_payload_in_metadata\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtProvider.NormalizePayload\",\n          \"additionalProperties\": false,\n          \"description\": \"Normalizes the payload representation in the request metadata.\"\n        },\n        \"header_in_metadata\": {\n          \"type\": \"string\",\n          \"description\": \"If not empty, similar to :ref:`payload_in_metadata `, a successfully verified JWT header will be written to :ref:`Dynamic State ` as an entry (``protobuf::Struct``) in ``envoy.filters.http.jwt_authn`` ``namespace`` with the value of this field as the key. For example, if ``header_in_metadata`` is ``my_header``: .. code-block:: yaml   envoy.filters.http.jwt_authn:     my_header:       alg: JWT       kid: EF71iSaosbC5C4tC6Syq1Gm647M       alg: PS256 When the metadata has ``envoy.filters.http.jwt_authn`` entry already (for example if :ref:`payload_in_metadata ` is not empty), it will be inserted as a new entry in the same ``namespace`` as shown below: .. code-block:: yaml   envoy.filters.http.jwt_authn:     my_payload:       iss: https://example.com       sub: test@example.com       aud: https://example.com       exp: 1501281058     my_header:       alg: JWT       kid: EF71iSaosbC5C4tC6Syq1Gm647M       alg: PS256 .. warning::    Using the same key name for :ref:`header_in_metadata `    and :ref:`payload_in_metadata `    is not suggested due to potential override of existing entry, while it is not enforced during    config validation.\"\n        },\n        \"failed_status_in_metadata\": {\n          \"type\": \"string\",\n          \"description\": \"If non empty, the failure status ``::google::jwt_verify::Status`` for a non verified JWT will be written to StreamInfo DynamicMetadata in the format as: ``namespace`` is the jwt_authn filter name as ``envoy.filters.http.jwt_authn`` The value is the ``protobuf::Struct``. The values of this field will be ``code`` and ``message`` and they will contain the JWT authentication failure status code and a message describing the failure. For example, if failed_status_in_metadata is ``my_auth_failure_status``: .. code-block:: yaml   envoy.filters.http.jwt_authn:     my_auth_failure_status:       code: 3       message: Jwt expired\"\n        },\n        \"clock_skew_seconds\": {\n          \"type\": \"integer\",\n          \"description\": \"Specify the clock skew in seconds when verifying JWT time constraint, such as ``exp``, and ``nbf``. If not specified, default is 60 seconds.\"\n        },\n        \"jwt_cache_config\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtCacheConfig\",\n          \"additionalProperties\": false,\n          \"description\": \"Enables JWT cache, its size is specified by ``jwt_cache_size``. Only valid JWTs are cached.\"\n        },\n        \"claim_to_headers\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtClaimToHeader\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Add JWT claim to HTTP Header Specify the claim name you want to copy in which HTTP header. For examples, following config: The claim must be of type; string, int, double, bool. Array type claims are not supported .. literalinclude:: /_configs/repo/jwt_authn.yaml    :language: yaml    :lines: 44-48    :linenos:    :lineno-start: 44    :caption: :download:`jwt_authn.yaml </_configs/repo/jwt_authn.yaml>` This header is only reserved for jwt claim; any other value will be overwritten.\"\n        },\n        \"clear_route_cache\": {\n          \"type\": \"boolean\",\n          \"description\": \"Clears route cache in order to allow the JWT to correctly affect routing decisions. Filter clears all cached routes when: 1. The field is set to ``true``. 2. At least one ``claim_to_headers`` header is added to the request OR    if ``payload_in_metadata`` is set.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: JWT Authentication]\\n JWT Authentication :ref:`configuration overview `.\\n [#extension: envoy.filters.http.jwt_authn]\",\n      \"description\": \"[#protodoc-title: JWT Authentication] JWT Authentication :ref:`configuration overview `. [#extension: envoy.filters.http.jwt_authn]  Please see following for JWT authentication flow: * `JSON Web Token (JWT) `_ * `The OAuth 2.0 Authorization Framework `_ * `OpenID Connect `_ A JwtProvider message specifies how a JSON Web Token (JWT) can be verified. It specifies: * issuer: the principal that issues the JWT. If specified, it has to match the ``iss`` field in JWT. * allowed audiences: the ones in the token have to be listed here. * how to fetch public key JWKS to verify the token signature. * how to extract the JWT in the request. * how to pass successfully verified token payload. Example: .. code-block:: yaml     issuer: https://example.com     audiences:     - bookstore_android.apps.googleusercontent.com     - bookstore_web.apps.googleusercontent.com     remote_jwks:       http_uri:         uri: https://example.com/.well-known/jwks.json         cluster: example_jwks_cluster         timeout: 1s       cache_duration:         seconds: 300 [#next-free-field: 22]\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtProvider.NormalizePayload\": {\n      \"properties\": {\n        \"space_delimited_claims\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Each claim in this list will be interpreted as a space-delimited string and converted to a list of strings based on the delimited values. Example: a token with a claim ``scope: \\\"email profile\\\"`` is translated to dynamic metadata  ``scope: [\\\"email\\\", \\\"profile\\\"]`` if this field is set value ``[\\\"scope\\\"]``. This special handling of ``scope`` is recommended by `RFC8693 `_.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Normalize Payload\",\n      \"description\": \"Alters the payload representation in the request dynamic metadata to facilitate its use in matching.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement\": {\n      \"properties\": {\n        \"provider_name\": {\n          \"type\": \"string\",\n          \"description\": \"Specify a required provider name.\"\n        },\n        \"provider_and_audiences\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.ProviderWithAudiences\",\n          \"additionalProperties\": false,\n          \"description\": \"Specify a required provider with audiences.\"\n        },\n        \"requires_any\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirementOrList\",\n          \"additionalProperties\": false,\n          \"description\": \"Specify list of JwtRequirement. Their results are OR-ed. If any one of them passes, the result is passed.\"\n        },\n        \"requires_all\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirementAndList\",\n          \"additionalProperties\": false,\n          \"description\": \"Specify list of JwtRequirement. Their results are AND-ed. All of them must pass, if one of them fails or missing, it fails.\"\n        },\n        \"allow_missing_or_failed\": {\n          \"additionalProperties\": false,\n          \"type\": \"object\",\n          \"description\": \"The requirement is always satisfied even if JWT is missing or the JWT verification fails. A typical usage is: this filter is used to only verify JWTs and pass the verified JWT payloads to another filter, the other filter will make decision. In this mode, all JWTs will be verified.\"\n        },\n        \"allow_missing\": {\n          \"additionalProperties\": false,\n          \"type\": \"object\",\n          \"description\": \"The requirement is satisfied if JWT is missing, but failed if JWT is presented but invalid. Similar to allow_missing_or_failed, this is used to only verify JWTs and pass the verified payload to another filter. The different is this mode will reject requests with invalid tokens.\"\n        },\n        \"extract_only_without_validation\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.ExtractOnlyWithoutValidation\",\n          \"additionalProperties\": false,\n          \"description\": \"[#next-major-version: consider removing or gating behind explicit opt-in] .. warning::    SECURITY WARNING: This mode does NOT verify JWT signatures. Any party    can forge a JWT with arbitrary claims, and those claims will be extracted    and forwarded as HTTP headers. Headers set by this mode are    INDISTINGUISHABLE from headers set by fully validated JWTs unless the    ``verification_status_header`` is checked by downstream filters    (set to ``false`` by default on all extract-only requests).    DO NOT use this mode if:      - RBAC policies match on JWT-derived headers      - ext_authz services trust JWT-derived headers      - Backend services use JWT-derived headers for authorization      - The JWT source is not cryptographically authenticated by other means    Use only when signature verification is PROVABLY performed elsewhere    in the request path (e.g., by an upstream mTLS-authenticated service).\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Requirement\",\n      \"description\": \"This message specifies a Jwt requirement. An empty message means JWT verification is not required. Here are some config examples: .. code-block:: yaml  # Example 1: not required with an empty message  # Example 2: require A  provider_name: provider-A  # Example 3: require A or B  requires_any:    requirements:      - provider_name: provider-A      - provider_name: provider-B  # Example 4: require A and B  requires_all:    requirements:      - provider_name: provider-A      - provider_name: provider-B  # Example 5: require A and (B or C)  requires_all:    requirements:      - provider_name: provider-A      - requires_any:        requirements:          - provider_name: provider-B          - provider_name: provider-C  # Example 6: require A or (B and C)  requires_any:    requirements:      - provider_name: provider-A      - requires_all:        requirements:          - provider_name: provider-B          - provider_name: provider-C  # Example 7: A is optional (if token from A is provided, it must be valid, but also allows  missing token.)  requires_any:    requirements:    - provider_name: provider-A    - allow_missing: {}  # Example 8: A is optional and B is required.  requires_all:    requirements:    - requires_any:        requirements:        - provider_name: provider-A        - allow_missing: {}    - provider_name: provider-B [#next-free-field: 8]\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtRequirementAndList\": {\n      \"properties\": {\n        \"requirements\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specify a list of JwtRequirement.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Requirement And List\",\n      \"description\": \"This message specifies a list of RequiredProvider. Their results are AND-ed; all of them must pass, if one of them fails or missing, it fails.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.JwtRequirementOrList\": {\n      \"properties\": {\n        \"requirements\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Specify a list of JwtRequirement.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Jwt Requirement Or List\",\n      \"description\": \"This message specifies a list of RequiredProvider. Their results are OR-ed; if any one of them passes, the result is passed\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.ProviderWithAudiences\": {\n      \"properties\": {\n        \"provider_name\": {\n          \"type\": \"string\",\n          \"description\": \"Specify a required provider name.\"\n        },\n        \"audiences\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"This field overrides the one specified in the JwtProvider.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Provider With Audiences\",\n      \"description\": \"Specify a required provider with audiences.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.RemoteJwks\": {\n      \"properties\": {\n        \"http_uri\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.HttpUri\",\n          \"additionalProperties\": false,\n          \"description\": \"The HTTP URI to fetch the JWKS. For example: .. code-block:: yaml    http_uri:      uri: https://www.googleapis.com/oauth2/v1/certs      cluster: jwt.www.googleapis.com|443      timeout: 1s\"\n        },\n        \"cache_duration\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"Duration after which the cached JWKS should be expired. If not specified, default cache duration is 10 minutes.\",\n          \"format\": \"regex\"\n        },\n        \"async_fetch\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwksAsyncFetch\",\n          \"additionalProperties\": false,\n          \"description\": \"Fetch Jwks asynchronously in the main thread before the listener is activated. Fetched Jwks can be used by all worker threads. If this feature is not enabled: * The Jwks is fetched on-demand when the requests come. During the fetching, first   few requests are paused until the Jwks is fetched. * Each worker thread fetches its own Jwks since Jwks cache is per worker thread. If this feature is enabled: * Fetched Jwks is done in the main thread before the listener is activated. Its fetched   Jwks can be used by all worker threads. Each worker thread doesn't need to fetch its own. * Jwks is ready when the requests come, not need to wait for the Jwks fetching.\"\n        },\n        \"retry_policy\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.RetryPolicy\",\n          \"additionalProperties\": false,\n          \"description\": \"Retry policy for fetching Jwks. optional. turned off by default. For example: .. code-block:: yaml   retry_policy:     retry_back_off:       base_interval: 0.01s       max_interval: 20s     num_retries: 10 will yield a randomized truncated exponential backoff policy with an initial delay of 10ms 10 maximum attempts spaced at most 20s seconds. .. code-block:: yaml   retry_policy:     num_retries:1 uses the default :ref:`retry backoff strategy `. with the default base interval is 1000 milliseconds. and the default maximum interval of 10 times the base interval. if num_retries is omitted, the default is to allow only one retry. If enabled, the retry policy will apply to all Jwks fetching approaches, e.g. on demand or asynchronously in background.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Remote Jwks\",\n      \"description\": \"This message specifies how to fetch JWKS from remote and how to cache it.\"\n    },\n    \"envoy.extensions.filters.http.jwt_authn.v3.RequirementRule\": {\n      \"properties\": {\n        \"match\": {\n          \"$ref\": \"#/definitions/envoy.config.route.v3.RouteMatch\",\n          \"additionalProperties\": false,\n          \"description\": \"The route matching parameter. Only when the match is satisfied, the \\\"requires\\\" field will apply. For example: following match will match all requests. .. code-block:: yaml    match:      prefix: /\"\n        },\n        \"requires\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.jwt_authn.v3.JwtRequirement\",\n          \"additionalProperties\": false,\n          \"description\": \"Specify a Jwt requirement. Please see detail comment in message JwtRequirement.\"\n        },\n        \"requirement_name\": {\n          \"minLength\": 1,\n          \"type\": \"string\",\n          \"description\": \"Use requirement_name to specify a Jwt requirement. This requirement_name MUST be specified at the :ref:`requirement_map ` in ``JwtAuthentication``.\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Requirement Rule\",\n      \"description\": \"This message specifies a Jwt requirement for a specific Route condition. Example 1: .. code-block:: yaml    - match:        prefix: /healthz In above example, \\\"requires\\\" field is empty for /healthz prefix match, it means that requests matching the path prefix don't require JWT authentication. Example 2: .. code-block:: yaml    - match:        prefix: /      requires: { provider_name: provider-A } In above example, all requests matched the path prefix require jwt authentication from \\\"provider-A\\\".\"\n    },\n    \"Router\": {\n      \"properties\": {\n        \"dynamic_stats\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"Whether the router generates dynamic cluster statistics. Defaults to true. Can be disabled in high performance scenarios.\"\n        },\n        \"start_child_span\": {\n          \"type\": \"boolean\",\n          \"description\": \"Whether to start a child span for egress routed calls. This can be useful in scenarios where other filters (auth, ratelimit, etc.) make outbound calls and have child spans rooted at the same ingress parent. Defaults to false. .. attention::   This field is deprecated by the   :ref:`spawn_upstream_span `.   Please use that ``spawn_upstream_span`` field to control the span creation.\"\n        },\n        \"upstream_log\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.config.accesslog.v3.AccessLog\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Configuration for HTTP upstream logs emitted by the router. Upstream logs are configured in the same way as access logs, but each log entry represents an upstream request. Presuming retries are configured, multiple upstream requests may be made for each downstream (inbound) request.\"\n        },\n        \"upstream_log_options\": {\n          \"$ref\": \"#/definitions/envoy.extensions.filters.http.router.v3.Router.UpstreamAccessLogOptions\",\n          \"additionalProperties\": false,\n          \"description\": \"Additional upstream access log options.\"\n        },\n        \"suppress_envoy_headers\": {\n          \"type\": \"boolean\",\n          \"description\": \"Do not add any additional ``x-envoy-`` headers to requests or responses. This only affects the :ref:`router filter generated x-envoy- headers `, other Envoy filters and the HTTP connection manager may continue to set ``x-envoy-`` headers.\"\n        },\n        \"strict_check_headers\": {\n          \"items\": {\n            \"type\": \"string\"\n          },\n          \"type\": \"array\",\n          \"description\": \"Specifies a list of HTTP headers to strictly validate. Envoy will reject a request and respond with HTTP status 400 if the request contains an invalid value for any of the headers listed in this field. Strict header checking is only supported for the following headers: Value must be a ','-delimited list (i.e. no spaces) of supported retry policy values: * :ref:`config_http_filters_router_x-envoy-retry-grpc-on` * :ref:`config_http_filters_router_x-envoy-retry-on` Value must be an integer: * :ref:`config_http_filters_router_x-envoy-max-retries` * :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms` * :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`\"\n        },\n        \"respect_expected_rq_timeout\": {\n          \"type\": \"boolean\",\n          \"description\": \"If not set, ingress Envoy will ignore :ref:`config_http_filters_router_x-envoy-expected-rq-timeout-ms` header, populated by egress Envoy, when deriving timeout for upstream cluster.\"\n        },\n        \"suppress_grpc_request_failure_code_stats\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set, Envoy will avoid incrementing HTTP failure code stats on gRPC requests. This includes the individual status code value (e.g. upstream_rq_504) and group stats (e.g. upstream_rq_5xx). This field is useful if interested in relying only on the gRPC stats filter to define success and failure metrics for gRPC requests as not all failed gRPC requests charge HTTP status code metrics. See :ref:`gRPC stats filter` documentation for more details.\"\n        },\n        \"upstream_http_filters\": {\n          \"items\": {\n            \"$ref\": \"#/definitions/envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter\"\n          },\n          \"additionalProperties\": false,\n          \"type\": \"array\",\n          \"description\": \"Optional HTTP filters for the upstream HTTP filter chain. .. note::   Upstream HTTP filters are currently in alpha. These filters will be applied for all requests that pass through the router. They will also be applied to shadowed requests. Upstream HTTP filters cannot change route or cluster. Upstream HTTP filters specified on the cluster will override these filters. If using upstream HTTP filters, please be aware that local errors sent by upstream HTTP filters will not trigger retries, and local errors sent by upstream HTTP filters will count as a final response if hedging is configured. [#extension-category: envoy.filters.http.upstream]\"\n        },\n        \"reject_connect_request_early_data\": {\n          \"additionalProperties\": false,\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, Envoy will reject ``CONNECT`` requests that send data before receiving a ``200`` response from the upstream. This early data behavior is common for latency reduction but can cause issues with some upstreams. Defaults to false to allow early data and be compatible with common behavior.\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Router]\\n Router :ref:`configuration overview `.\\n [#extension: envoy.filters.http.router]\",\n      \"description\": \"[#protodoc-title: Router] Router :ref:`configuration overview `. [#extension: envoy.filters.http.router]  [#next-free-field: 11]\"\n    },\n    \"envoy.extensions.filters.http.router.v3.Router.UpstreamAccessLogOptions\": {\n      \"properties\": {\n        \"flush_upstream_log_on_upstream_stream\": {\n          \"type\": \"boolean\",\n          \"description\": \"If set to true, an upstream access log will be recorded when an upstream stream is associated to an http request. Note: Each HTTP request received for an already established connection will result in an upstream access log record. This includes, for example, consecutive HTTP requests over the same connection or a request that is retried. In case a retry is applied, an upstream access log will be recorded for each retry.\"\n        },\n        \"upstream_log_flush_interval\": {\n          \"pattern\": \"^([0-9]+\\\\.?[0-9]*|\\\\.[0-9]+)s$\",\n          \"type\": \"string\",\n          \"description\": \"The interval to flush the upstream access logs. By default, the router will flush an upstream access log on stream close, when the HTTP request is complete. If this field is set, the router will flush access logs periodically at the specified interval. This is especially useful in the case of long-lived requests, such as CONNECT and Websockets. The interval must be at least 1 millisecond.\",\n          \"format\": \"regex\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"Upstream Access Log Options\"\n    },\n    \"StdoutAccessLog\": {\n      \"properties\": {\n        \"log_format\": {\n          \"$ref\": \"#/definitions/envoy.config.core.v3.SubstitutionFormatString\",\n          \"additionalProperties\": false,\n          \"description\": \"Configuration to form access log data and format. If not specified, use :ref:`default format `.\"\n        },\n        \"@type\": {\n          \"type\": \"string\"\n        }\n      },\n      \"additionalProperties\": false,\n      \"type\": \"object\",\n      \"title\": \"[#protodoc-title: Standard Streams Access loggers]\",\n      \"description\": \"[#protodoc-title: Standard Streams Access loggers]  Custom configuration for an :ref:`AccessLog ` that writes log entries directly to the operating system's standard output. [#extension: envoy.access_loggers.stdout]\"\n    }\n  }\n}\n", "creation_timestamp": "2026-10-08T19:41:16.000000Z"}