syntax = "proto3";

package envoy.config.filter.network.client_ssl_auth.v2;

import "envoy/api/v2/core/address.proto";

import "google/protobuf/duration.proto";

import "udpa/annotations/migrate.proto";
import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.config.filter.network.client_ssl_auth.v2";
option java_outer_classname = "ClientSslAuthProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/filter/network/client_ssl_auth/v2;client_ssl_authv2";
option (udpa.annotations.file_migrate).move_to_package =
    "envoy.extensions.filters.network.client_ssl_auth.v3";
option (udpa.annotations.file_status).package_version_status = FROZEN;

// [#protodoc-title: Client TLS authentication]
// Client TLS authentication
// :ref:`configuration overview <config_network_filters_client_ssl_auth>`.
// [#extension: envoy.filters.network.client_ssl_auth]

message ClientSSLAuth {
  // The :ref:`cluster manager <arch_overview_cluster_manager>` cluster that runs
  // the authentication service. The filter will connect to the service every 60s to fetch the list
  // of principals. The service must support the expected :ref:`REST API
  // <config_network_filters_client_ssl_auth_rest_api>`.
  string auth_api_cluster = 1 [(validate.rules).string = {min_bytes: 1}];

  // The prefix to use when emitting :ref:`statistics
  // <config_network_filters_client_ssl_auth_stats>`.
  string stat_prefix = 2 [(validate.rules).string = {min_bytes: 1}];

  // Time in milliseconds between principal refreshes from the
  // authentication service. Default is 60000 (60s). The actual fetch time
  // will be this value plus a random jittered value between
  // 0-refresh_delay_ms milliseconds.
  google.protobuf.Duration refresh_delay = 3;

  // An optional list of IP address and subnet masks that should be white
  // listed for access by the filter. If no list is provided, there is no
  // IP allowlist.
  repeated api.v2.core.CidrRange ip_white_list = 4;
}
