// WaitForHealthcheckInterval sets the time that skipper waits

// for the loadbalancer in front to become unhealthy. Defaults

// to 0.

WaitForHealthcheckInterval time.Duration

// StatusChecks is an experimental feature. It defines a

// comma separated list of HTTP URLs to do GET requests to,

// that have to return 200 before skipper becomes ready

StatusChecks []string

// WhitelistedHealthcheckCIDR appends the whitelisted IP Range to the inernalIPS range for healthcheck purposes

WhitelistedHealthCheckCIDR []string

// Network address that skipper should listen on.

Address string

// Insecure network address skipper should listen on when TLS is enabled

InsecureAddress string

// EnableTCPQueue enables controlling the

// concurrently processed requests at the TCP listener.

EnableTCPQueue bool

// ExpectedBytesPerRequest is used by the TCP LIFO listener.

// It defines the expected average memory required to process an incoming

// request. It is used only when MaxTCPListenerConcurrency is not defined.

// It is used together with the memory limit defined in:

// cgroup v1 /sys/fs/cgroup/memory/memory.limit_in_bytes

// or

// cgroup v2 /sys/fs/cgroup/memory.max

//

// See also:

// cgroup v1: https://www.kernel.org/doc/Documentation/cgroup-v1/memory.txt

// cgroup v2: https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html#memory-interface-files

ExpectedBytesPerRequest int

// MaxTCPListenerConcurrency is used by the TCP LIFO listener.

// It defines the max number of concurrently accepted connections, excluding

// the pending ones in the queue.

//

// When undefined and the EnableTCPQueue is true,

MaxTCPListenerConcurrency int

// MaxTCPListenerQueue is used by the TCP LIFO listener.

// If defines the maximum number of pending connection waiting in the queue.

MaxTCPListenerQueue int

// List of custom filter specifications.

CustomFilters []filters.Spec

// Urls of nodes in an etcd cluster, storing route definitions.

EtcdUrls []string

// Path prefix for skipper related data in the etcd storage.

EtcdPrefix string

// Timeout used for a single request when querying for updates

// in etcd. This is independent of, and an addition to,

// SourcePollTimeout. When not set, the internally defined 1s

// is used.

EtcdWaitTimeout time.Duration

// Skip TLS certificate check for etcd connections.

EtcdInsecure bool

// If set this value is used as Bearer token for etcd OAuth authorization.

EtcdOAuthToken string

// If set this value is used as username for etcd basic authorization.

EtcdUsername string

// If set this value is used as password for etcd basic authorization.

EtcdPassword string

// If set enables skipper to generate based on ingress resources in kubernetes cluster

Kubernetes bool

// If set makes skipper authenticate with the kubernetes API server with service account assigned to the

// skipper POD.

// If omitted skipper will rely on kubectl proxy to authenticate with API server

KubernetesInCluster bool

// Kubernetes API base URL. Only makes sense if KubernetesInCluster is set to false. If omitted and

// skipper is not running in-cluster, the default API URL will be used.

KubernetesURL string

// KubernetesTokenFile configures path to the token file.

// Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token when running in-cluster.

KubernetesTokenFile string

// KubernetesHealthcheck, when Kubernetes ingress is set, indicates

// whether an automatic healthcheck route should be generated. The

// generated route will report healthyness when the Kubernetes API

// calls are successful. The healthcheck endpoint is accessible from

// internal IPs, with the path /kube-system/healthz.

KubernetesHealthcheck bool

// KubernetesHTTPSRedirect, when Kubernetes ingress is set, indicates

// whether an automatic redirect route should be generated to redirect

// HTTP requests to their HTTPS equivalent. The generated route will

// match requests with the X-Forwarded-Proto and X-Forwarded-Port,

// expected to be set by the load-balancer.

KubernetesHTTPSRedirect bool

// KubernetesHTTPSRedirectCode overrides the default redirect code (308)

// when used together with -kubernetes-https-redirect.

KubernetesHTTPSRedirectCode int

// KubernetesDisableCatchAllRoutes, when set, tells the data client to not create catchall routes.

KubernetesDisableCatchAllRoutes bool

// KubernetesIngressClass is a regular expression, that will make

// skipper load only the ingress resources that have a matching

// kubernetes.io/ingress.class annotation. For backwards compatibility,

// the ingresses without an annotation, or an empty annotation, will

// be loaded, too.

KubernetesIngressClass string

// KubernetesRouteGroupClass is a regular expression, that will make skipper

// load only the RouteGroup resources that have a matching

// zalando.org/routegroup.class annotation. Any RouteGroups without the

// annotation, or which an empty annotation, will be loaded too.

KubernetesRouteGroupClass string

// KubernetesIngressLabelSelectors is a map of kubernetes labels to their values that must be present on a resource to be loaded

// by the client. A label and its value on an Ingress must be match exactly to be loaded by Skipper.

// If the value is irrelevant for a given configuration, it can be left empty. The default

// value is no labels required.

// Examples:

// Config [] will load all Ingresses.

// Config ["skipper-enabled": ""] will load only Ingresses with a label "skipper-enabled", no matter the value.

// Config ["skipper-enabled": "true"] will load only Ingresses with a label "skipper-enabled: true"

// Config ["skipper-enabled": "", "foo": "bar"] will load only Ingresses with both labels while label "foo" must have a value "bar".

KubernetesIngressLabelSelectors map[string]string

// KubernetesServicesLabelSelectors is a map of kubernetes labels to their values that must be present on a resource to be loaded

// by the client. Read documentation for IngressLabelSelectors for examples and more details.

// The default value is no labels required.

KubernetesServicesLabelSelectors map[string]string

// KubernetesEndpointsLabelSelectors is a map of kubernetes labels to their values that must be present on a resource to be loaded

// by the client. Read documentation for IngressLabelSelectors for examples and more details.

// The default value is no labels required.

KubernetesEndpointsLabelSelectors map[string]string

// KubernetesSecretsLabelSelectors is a map of kubernetes labels to their values that must be present on a resource to be loaded

// by the client. Read documentation for IngressLabelSelectors for examples and more details.

// The default value is no labels required.

KubernetesSecretsLabelSelectors map[string]string

// KubernetesRouteGroupsLabelSelectors is a map of kubernetes labels to their values that must be present on a resource to be loaded

// by the client. Read documentation for IngressLabelSelectors for examples and more details.

// The default value is no labels required.

KubernetesRouteGroupsLabelSelectors map[string]string

// PathMode controls the default interpretation of ingress paths in cases

// when the ingress doesn't specify it with an annotation.

KubernetesPathMode kubernetes.PathMode

// KubernetesNamespace is used to switch between monitoring ingresses in the cluster-scope or limit

// the ingresses to only those in the specified namespace. Defaults to "" which means monitor ingresses

// in the cluster-scope.

KubernetesNamespace string

// KubernetesEnableEndpointslices if set skipper will fetch

// endpointslices instead of endpoints to scale more than 1000

// pods within a service

KubernetesEnableEndpointslices bool

// *DEPRECATED* KubernetesEnableEastWest enables cluster internal service to service communication, aka east-west traffic

KubernetesEnableEastWest bool

// *DEPRECATED* KubernetesEastWestDomain sets the cluster internal domain used to create additional routes in skipper, defaults to skipper.cluster.local

KubernetesEastWestDomain string

// KubernetesEastWestRangeDomains set the the cluster internal domains for

// east west traffic. Identified routes to such domains will include

// the KubernetesEastWestRangePredicates.

KubernetesEastWestRangeDomains []string

// KubernetesEastWestRangePredicates set the Predicates that will be

// appended to routes identified as to KubernetesEastWestRangeDomains.

KubernetesEastWestRangePredicates []*eskip.Predicate

// KubernetesOnlyAllowedExternalNames will enable validation of ingress external names and route groups network

// backend addresses, explicit LB endpoints validation against the list of patterns in

// AllowedExternalNames.

KubernetesOnlyAllowedExternalNames bool

// KubernetesAllowedExternalNames contains regexp patterns of those domain names that are allowed to be

// used with external name services (type=ExternalName).

KubernetesAllowedExternalNames []*regexp.Regexp

// KubernetesRedisServiceNamespace to be used to lookup ring shards dynamically

KubernetesRedisServiceNamespace string

// KubernetesRedisServiceName to be used to lookup ring shards dynamically

KubernetesRedisServiceName string

// KubernetesRedisServicePort to be used to lookup ring shards dynamically

KubernetesRedisServicePort int

// KubernetesForceService overrides the default Skipper functionality to route traffic using Kubernetes Endpoints,

// instead using Kubernetes Services.

KubernetesForceService bool

// KubernetesBackendTrafficAlgorithm specifies the algorithm to calculate the backend traffic

KubernetesBackendTrafficAlgorithm kubernetes.BackendTrafficAlgorithm

// KubernetesDefaultLoadBalancerAlgorithm sets the default algorithm to be used for load balancing between backend endpoints,

// available options: roundRobin, consistentHash, random, powerOfRandomNChoices

KubernetesDefaultLoadBalancerAlgorithm string

// File containing static route definitions. Multiple may be given comma separated.

RoutesFile string

// File containing route definitions with file watch enabled.

// Multiple may be given comma separated. (For the skipper

// command this option is used when starting it with the -routes-file flag.)

WatchRoutesFile string

// RouteURLs are URLs pointing to route definitions, in eskip format, with change watching enabled.

RoutesURLs []string

// InlineRoutes can define routes as eskip text.

InlineRoutes string

// Polling timeout of the routing data sources.

SourcePollTimeout time.Duration

// DefaultFilters will be applied to all routes automatically.

DefaultFilters *eskip.DefaultFilters

// DisabledFilters is a list of filters unavailable for use

DisabledFilters []string

// CloneRoute is a slice of PreProcessors that will be applied to all routes

// automatically. They will clone all matching routes and apply changes to the

// cloned routes.

CloneRoute []*eskip.Clone

// EditRoute will be applied to all routes automatically and

// will apply changes to all matching routes.

EditRoute []*eskip.Editor

// A list of custom routing pre-processor implementations that will

// be applied to all routes.

CustomRoutingPreProcessors []routing.PreProcessor

// Deprecated. See ProxyFlags. When used together with ProxyFlags,

// the values will be combined with |.

ProxyOptions proxy.Options

// Flags controlling the proxy behavior.

ProxyFlags proxy.Flags

// Tells the proxy maximum how many idle connections can it keep

// alive.

IdleConnectionsPerHost int

// Defines the time period of how often the idle connections maintained

// by the proxy are closed.

CloseIdleConnsPeriod time.Duration

// Defines ReadTimeoutServer for server http connections.

ReadTimeoutServer time.Duration

// Defines ReadHeaderTimeout for server http connections.

ReadHeaderTimeoutServer time.Duration

// Defines WriteTimeout for server http connections.

WriteTimeoutServer time.Duration

// Defines IdleTimeout for server http connections.

IdleTimeoutServer time.Duration

// Defines MaxHeaderBytes for server http connections.

MaxHeaderBytes int

// Enable connection state metrics for server http connections.

EnableConnMetricsServer bool

// TimeoutBackend sets the TCP client connection timeout for

// proxy http connections to the backend.

TimeoutBackend time.Duration

// ResponseHeaderTimeout sets the HTTP response timeout for

// proxy http connections to the backend.

ResponseHeaderTimeoutBackend time.Duration

// ExpectContinueTimeoutBackend sets the HTTP timeout to expect a

// response for status Code 100 for proxy http connections to

// the backend.

ExpectContinueTimeoutBackend time.Duration

// KeepAliveBackend sets the TCP keepalive for proxy http

// connections to the backend.

KeepAliveBackend time.Duration

// DualStackBackend sets if the proxy TCP connections to the

// backend should be dual stack.

DualStackBackend bool

// TLSHandshakeTimeoutBackend sets the TLS handshake timeout

// for proxy connections to the backend.

TLSHandshakeTimeoutBackend time.Duration

// MaxIdleConnsBackend sets MaxIdleConns, which limits the

// number of idle connections to all backends, 0 means no

// limit.

MaxIdleConnsBackend int

// DisableHTTPKeepalives sets DisableKeepAlives, which forces

// a backend to always create a new connection.

DisableHTTPKeepalives bool

// Flag indicating to ignore trailing slashes in paths during route

// lookup.

IgnoreTrailingSlash bool

// Priority routes that are matched against the requests before

// the standard routes from the data clients.

PriorityRoutes []proxy.PriorityRoute

// Specifications of custom, user defined predicates.

CustomPredicates []routing.PredicateSpec

// Custom data clients to be used together with the default etcd and Innkeeper.

CustomDataClients []routing.DataClient

// CustomHttpHandlerWrap provides ability to wrap http.Handler created by skipper.

// http.Handler is used for accepting incoming http requests.

// It allows to add additional logic (for example tracing) by providing a wrapper function

// which accepts original skipper handler as an argument and returns a wrapped handler

CustomHttpHandlerWrap func(http.Handler) http.Handler

// CustomHttpRoundTripperWrap provides ability to wrap http.RoundTripper created by skipper.

// http.RoundTripper is used for making outgoing requests (backends)

// It allows to add additional logic (for example tracing) by providing a wrapper function

// which accepts original skipper http.RoundTripper as an argument and returns a wrapped roundtripper

CustomHttpRoundTripperWrap func(http.RoundTripper) http.RoundTripper

// WaitFirstRouteLoad prevents starting the listener before the first batch

// of routes were applied.

WaitFirstRouteLoad bool

// SuppressRouteUpdateLogs indicates to log only summaries of the routing updates

// instead of full details of the updated/deleted routes.

SuppressRouteUpdateLogs bool

// Dev mode. Currently this flag disables prioritization of the

// consumer side over the feeding side during the routing updates to

// populate the updated routes faster.

DevMode bool

// Network address for the support endpoints

SupportListener string

// Deprecated: Network address for the /metrics endpoint

MetricsListener string

// Skipper provides a set of metrics with different keys which are exposed via HTTP in JSON

// You can customize those key names with your own prefix

MetricsPrefix string

// EnableProfile exposes profiling information on /profile of the

// metrics listener.

EnableProfile bool

// BlockProfileRate calls runtime.SetBlockProfileRate(BlockProfileRate) if non zero value, deactivate with <0

BlockProfileRate int

// MutexProfileFraction calls runtime.SetMutexProfileFraction(MutexProfileFraction) if non zero value, deactivate with <0

MutexProfileFraction int

// MemProfileRate calls runtime.SetMemProfileRate(MemProfileRate) if non zero value, deactivate with <0

MemProfileRate int

// Flag that enables reporting of the Go garbage collector statistics exported in debug.GCStats

EnableDebugGcMetrics bool

// Flag that enables reporting of the Go runtime statistics exported in runtime and specifically runtime.MemStats

EnableRuntimeMetrics bool

// If set, detailed response time metrics will be collected

// for each route, additionally grouped by status and method.

EnableServeRouteMetrics bool

// If set, a counter for each route is generated, additionally

// grouped by status and method. It differs from the automatically

// generated counter from `EnableServeRouteMetrics` because it will

// always contain the status and method labels, independently of the

// `EnableServeMethodMetric` and `EnableServeStatusCodeMetric` flags.

EnableServeRouteCounter bool

// If set, detailed response time metrics will be collected

// for each host, additionally grouped by status and method.

EnableServeHostMetrics bool

// If set, a counter for each host is generated, additionally

// grouped by status and method. It differs from the automatically

// generated counter from `EnableServeHostMetrics` because it will

// always contain the status and method labels, independently of the

// `EnableServeMethodMetric` and `EnableServeStatusCodeMetric` flags.

EnableServeHostCounter bool

// If set, the detailed total response time metrics will contain the

// HTTP method as a domain of the metric. It affects both route and

// host split metrics.

EnableServeMethodMetric bool

// If set, the detailed total response time metrics will contain the

// HTTP Response status code as a domain of the metric. It affects

// both route and host split metrics.

EnableServeStatusCodeMetric bool

// If set, detailed response time metrics will be collected

// for each backend host

EnableBackendHostMetrics bool

// EnableAllFiltersMetrics enables collecting combined filter

// metrics per each route. Without the DisableMetricsCompatibilityDefaults,

// it is enabled by default.

EnableAllFiltersMetrics bool

// EnableCombinedResponseMetrics enables collecting response time

// metrics combined for every route.

EnableCombinedResponseMetrics bool

// EnableRouteResponseMetrics enables collecting response time

// metrics per each route. Without the DisableMetricsCompatibilityDefaults,

// it is enabled by default.

EnableRouteResponseMetrics bool

// EnableRouteBackendErrorsCounters enables counters for backend

// errors per each route. Without the DisableMetricsCompatibilityDefaults,

// it is enabled by default.

EnableRouteBackendErrorsCounters bool

// EnableRouteStreamingErrorsCounters enables counters for streaming

// errors per each route. Without the DisableMetricsCompatibilityDefaults,

// it is enabled by default.

EnableRouteStreamingErrorsCounters bool

// EnableRouteBackendMetrics enables backend response time metrics

// per each route. Without the DisableMetricsCompatibilityDefaults, it is

// enabled by default.

EnableRouteBackendMetrics bool

// EnableRouteCreationMetrics enables the OriginMarker to track route creation times. Disabled by default

EnableRouteCreationMetrics bool

// When set, makes the histograms use an exponentially decaying sample

// instead of the default uniform one.

MetricsUseExpDecaySample bool

// Use custom buckets for prometheus histograms.

HistogramMetricBuckets []float64

// The following options, for backwards compatibility, are true

// by default: EnableAllFiltersMetrics, EnableRouteResponseMetrics,

// EnableRouteBackendErrorsCounters, EnableRouteStreamingErrorsCounters,

// EnableRouteBackendMetrics. With this compatibility flag, the default

// for these options can be set to false.

DisableMetricsCompatibilityDefaults bool

// Implementation of a Metrics handler. If provided this is going to be used

// instead of creating a new one based on the Kind of metrics wanted. This

// is useful in case you want to report metrics to a custom aggregator.

MetricsBackend metrics.Metrics

// Output file for the application log. Default value: /dev/stderr.

//

// When /dev/stderr or /dev/stdout is passed in, it will be resolved

// to os.Stderr or os.Stdout.

//

// Warning: passing an arbitrary file will try to open it append

// on start and use it, or fail on start, but the current

// implementation doesn't support any more proper handling

// of temporary failures or log-rolling.

ApplicationLogOutput string

// Application log prefix. Default value: "[APP]".

ApplicationLogPrefix string

// Enables logs in JSON format

ApplicationLogJSONEnabled bool

// ApplicationLogJsonFormatter, when set and JSON logging is enabled, is passed along to to the underlying

// Logrus logger for application logs. To enable structured logging, use ApplicationLogJSONEnabled.

ApplicationLogJsonFormatter *log.JSONFormatter

// Output file for the access log. Default value: /dev/stderr.

//

// When /dev/stderr or /dev/stdout is passed in, it will be resolved

// to os.Stderr or os.Stdout.

//

// Warning: passing an arbitrary file will try to open for append

// it on start and use it, or fail on start, but the current

// implementation doesn't support any more proper handling

// of temporary failures or log-rolling.

AccessLogOutput string

// Disables the access log.

AccessLogDisabled bool

// Enables logs in JSON format

AccessLogJSONEnabled bool

// AccessLogStripQuery, when set, causes the query strings stripped

// from the request URI in the access logs.

AccessLogStripQuery bool

// AccessLogJsonFormatter, when set and JSON logging is enabled, is passed along to to the underlying

// Logrus logger for access logs. To enable structured logging, use AccessLogJSONEnabled.

AccessLogJsonFormatter *log.JSONFormatter

DebugListener string

// Path of certificate(s) when using TLS, multiple may be given comma separated

CertPathTLS string

// Path of key(s) when using TLS, multiple may be given comma separated. For

// multiple keys, the order must match the one given in CertPathTLS

KeyPathTLS string

// TLS Settings for Proxy Server

ProxyTLS *tls.Config

// Client TLS to connect to Backends

ClientTLS *tls.Config

// TLSMinVersion to set the minimal TLS version for all TLS configurations

TLSMinVersion uint16

// Flush interval for upgraded Proxy connections

BackendFlushInterval time.Duration

// Experimental feature to handle protocol Upgrades for Websockets, SPDY, etc.

ExperimentalUpgrade bool

// ExperimentalUpgradeAudit enables audit log of both the request line

// and the response messages during web socket upgrades.

ExperimentalUpgradeAudit bool

// MaxLoopbacks defines the maximum number of loops that the proxy can execute when the routing table

// contains loop backends (<loopback>).

MaxLoopbacks int

// EnableBreakers enables the usage of the breakers in the route definitions without initializing any

// by default. It is a shortcut for setting the BreakerSettings to:

//

// []circuit.BreakerSettings{{Type: BreakerDisabled}}

//

EnableBreakers bool

// BreakerSettings contain global and host specific settings for the circuit breakers.

BreakerSettings []circuit.BreakerSettings

// EnableRatelimiters enables the usage of the ratelimiter in the route definitions without initializing any

// by default. It is a shortcut for setting the RatelimitSettings to:

//

// []ratelimit.Settings{{Type: DisableRatelimit}}

//

EnableRatelimiters bool

// RatelimitSettings contain global and host specific settings for the ratelimiters.

RatelimitSettings []ratelimit.Settings

// EnableRouteFIFOMetrics enables metrics for the individual route FIFO queues, if any.

EnableRouteFIFOMetrics bool

// EnableRouteLIFOMetrics enables metrics for the individual route LIFO queues, if any.

EnableRouteLIFOMetrics bool

// OpenTracing enables opentracing

OpenTracing []string

// OpenTracingInitialSpan can override the default initial, pre-routing, span name.

// Default: "ingress".

OpenTracingInitialSpan string

// OpenTracingExcludedProxyTags can disable a tag so that it is not recorded. By default every tag is included.

OpenTracingExcludedProxyTags []string

// OpenTracingDisableFilterSpans flag is used to disable creation of spans representing request and response filters.

OpenTracingDisableFilterSpans bool

// OpenTracingLogFilterLifecycleEvents flag is used to enable/disable the logs for events marking request and

// response filters' start & end times.

OpenTracingLogFilterLifecycleEvents bool

// OpenTracingLogStreamEvents flag is used to enable/disable the logs that marks the

// times when response headers & payload are streamed to the client

OpenTracingLogStreamEvents bool

// OpenTracingBackendNameTag enables an additional tracing tag containing a backend name

// for a route when it's available (e.g. for RouteGroups)

OpenTracingBackendNameTag bool

// OpenTracingTracer allows pre-created tracer to be passed on to skipper. Providing the

// tracer instance overrides options provided under OpenTracing property.

OpenTracingTracer ot.Tracer

// PluginDir defines the directory to load plugins from, DEPRECATED, use PluginDirs

PluginDir string

// PluginDirs defines the directories to load plugins from

PluginDirs []string

// FilterPlugins loads additional filters from modules. The first value in each []string

// needs to be the plugin name (as on disk, without path, without ".so" suffix). The

// following values are passed as arguments to the plugin while loading, see also

// https://opensource.zalando.com/skipper/reference/plugins/

FilterPlugins [][]string

// PredicatePlugins loads additional predicates from modules. See above for FilterPlugins

// what the []string should contain.

PredicatePlugins [][]string

// DataClientPlugins loads additional data clients from modules. See above for FilterPlugins

// what the []string should contain.

DataClientPlugins [][]string

// Plugins combine multiple types of the above plugin types in one plugin (where

// necessary because of shared data between e.g. a filter and a data client).

Plugins [][]string

// DefaultHTTPStatus is the HTTP status used when no routes are found

// for a request.

DefaultHTTPStatus int

// EnablePrometheusMetrics enables Prometheus format metrics.

//

// This option is *deprecated*. The recommended way to enable prometheus metrics is to

// use the MetricsFlavours option.

EnablePrometheusMetrics bool

// An instance of a Prometheus registry. It allows registering and serving custom metrics when skipper is used as a

// library.

// A new registry is created if this option is nil.

PrometheusRegistry *prometheus.Registry

// MetricsFlavours sets the metrics storage and exposed format

// of metrics endpoints.

MetricsFlavours []string

// LoadBalancerHealthCheckInterval is *deprecated* and not in use anymore

LoadBalancerHealthCheckInterval time.Duration

// ReverseSourcePredicate enables the automatic use of IP

// whitelisting in different places to use the reversed way of

// identifying a client IP within the X-Forwarded-For

// header. Amazon's ALB for example writes the client IP to

// the last item of the string list of the X-Forwarded-For

// header, in this case you want to set this to true.

ReverseSourcePredicate bool

// EnableOAuth2GrantFlow, enables OAuth2 Grant Flow filter

EnableOAuth2GrantFlow bool

// OAuth2AuthURL, the url to redirect the requests to when login is required.

OAuth2AuthURL string

// OAuth2TokenURL, the url where the access code should be exchanged for the

// access token.

OAuth2TokenURL string

// OAuth2RevokeTokenURL, the url where the access and refresh tokens can be

// revoked during a logout.

OAuth2RevokeTokenURL string

// OAuthTokeninfoURL sets the the URL to be queried for

// information for all auth.NewOAuthTokeninfo*() filters.

OAuthTokeninfoURL string

// OAuthTokeninfoTimeout sets timeout duration while calling oauth token service

OAuthTokeninfoTimeout time.Duration

// OAuthTokeninfoCacheSize configures the maximum number of cached tokens.

// Zero value disables tokeninfo cache.

OAuthTokeninfoCacheSize int

// OAuthTokeninfoCacheTTL limits the lifetime of a cached tokeninfo.

// Tokeninfo is cached for the duration of "expires_in" field value seconds or

// for the duration of OAuthTokeninfoCacheTTL if it is not zero and less than "expires_in" value.

OAuthTokeninfoCacheTTL time.Duration

// OAuth2SecretFile contains the filename with the encryption key for the

// authentication cookie and grant flow state stored in Secrets.

OAuth2SecretFile string

// OAuth2ClientID, the OAuth2 client id of the current service, used to exchange

// the access code.

OAuth2ClientID string

// OAuth2ClientSecret, the secret associated with the ClientID, used to exchange

// the access code.

OAuth2ClientSecret string

// OAuth2ClientIDFile, the path of the file containing the OAuth2 client id of

// the current service, used to exchange the access code.

// File name may contain {host} placeholder which will be replaced by the request host.

OAuth2ClientIDFile string

// OAuth2ClientSecretFile, the path of the file containing the secret associated

// with the ClientID, used to exchange the access code.

// File name may contain {host} placeholder which will be replaced by the request host.

OAuth2ClientSecretFile string

// OAuth2CallbackPath contains the path where the OAuth2 callback requests with the

// authorization code should be redirected to. Defaults to /.well-known/oauth2-callback

OAuth2CallbackPath string

// OAuthTokenintrospectionTimeout sets timeout duration while calling oauth tokenintrospection service

OAuthTokenintrospectionTimeout time.Duration

// OAuth2AuthURLParameters the additional parameters to send to OAuth2 authorize and token endpoints.

OAuth2AuthURLParameters map[string]string

// OAuth2AccessTokenHeaderName the name of the header to which the access token

// should be assigned after the oauthGrant filter.

OAuth2AccessTokenHeaderName string

// OAuth2TokeninfoSubjectKey the key of the subject ID attribute in the

// tokeninfo map. Used for downstream oidcClaimsQuery compatibility.

OAuth2TokeninfoSubjectKey string

// OAuth2GrantTokeninfoKeys, if not empty keys not in this list are removed from the tokeninfo map.

OAuth2GrantTokeninfoKeys []string

// OAuth2TokenCookieName the name of the cookie that Skipper sets after a

// successful OAuth2 token exchange. Stores the encrypted access token.

OAuth2TokenCookieName string

// OAuth2TokenCookieRemoveSubdomains sets the number of subdomains to remove from

// the callback request hostname to obtain token cookie domain.

OAuth2TokenCookieRemoveSubdomains int

// OAuth2GrantInsecure omits Secure attribute of the token cookie and uses http scheme for callback url.

OAuth2GrantInsecure bool

// OAuthGrantConfig specifies configuration for OAuth grant flow.

// A new instance will be created from OAuth* options when not specified.

OAuthGrantConfig *auth.OAuthConfig

// CompressEncodings, if not empty replace default compression encodings

CompressEncodings []string

// OIDCSecretsFile path to the file containing key to encrypt OpenID token

OIDCSecretsFile string

// OIDCCookieValidity sets validity time duration for Cookies to calculate expiration time. (default 1h).

OIDCCookieValidity time.Duration

// OIDCDistributedClaimsTimeout sets timeout duration while calling Distributed Claims endpoint.

OIDCDistributedClaimsTimeout time.Duration

// SecretsRegistry to store and load secretsencrypt

SecretsRegistry *secrets.Registry

// CredentialsPaths directories or files where credentials are stored one secret per file

CredentialsPaths []string

// CredentialsUpdateInterval sets the interval to update secrets

CredentialsUpdateInterval time.Duration

// API Monitoring feature is active (feature toggle)

ApiUsageMonitoringEnable bool

ApiUsageMonitoringRealmKeys string

ApiUsageMonitoringClientKeys string

ApiUsageMonitoringRealmsTrackingPattern string

// *DEPRECATED* ApiUsageMonitoringDefaultClientTrackingPattern

ApiUsageMonitoringDefaultClientTrackingPattern string

// Default filters directory enables default filters mechanism and sets the directory where the filters are located

DefaultFiltersDir string

// WebhookTimeout sets timeout duration while calling a custom webhook auth service

WebhookTimeout time.Duration

// MaxAuditBody sets the maximum read size of the body read by the audit log filter

MaxAuditBody int

// MaxMatcherBufferSize sets the maximum read buffer size of blockContent filter defaults to 2MiB

MaxMatcherBufferSize uint64

// EnableSwarm enables skipper fleet communication, required by e.g.

// the cluster ratelimiter

EnableSwarm bool

// redis based swarm

SwarmRedisURLs []string

SwarmRedisPassword string

SwarmRedisHashAlgorithm string

SwarmRedisDialTimeout time.Duration

SwarmRedisReadTimeout time.Duration

SwarmRedisWriteTimeout time.Duration

SwarmRedisPoolTimeout time.Duration

SwarmRedisMinIdleConns int

SwarmRedisMaxIdleConns int

SwarmRedisEndpointsRemoteURL string

SwarmRedisConnMetricsInterval time.Duration

SwarmRedisUpdateInterval time.Duration

// swim based swarm

SwarmKubernetesNamespace string

SwarmKubernetesLabelSelectorKey string

SwarmKubernetesLabelSelectorValue string

SwarmPort int

SwarmMaxMessageBuffer int

SwarmLeaveTimeout time.Duration

// swim based swarm for local testing

SwarmStaticSelf string // 127.0.0.1:9001

SwarmStaticOther string // 127.0.0.1:9002,127.0.0.1:9003

// SwarmRegistry specifies an optional callback function that is

// called after ratelimit registry is initialized

SwarmRegistry func(*ratelimit.Registry)

// ClusterRatelimitMaxGroupShards specifies the maximum number of group shards for the clusterRatelimit filter

ClusterRatelimitMaxGroupShards int

// KubernetesEnableTLS enables kubernetes to use resources to terminate tls

KubernetesEnableTLS bool

// LuaModules that are allowed to be used.

//

// Use <module>.<symbol> to selectively enable module symbols,

// for example: package,base._G,base.print,json

LuaModules []string

// LuaSources that are allowed as input sources. Valid sources

// are "", "file", "inline", "file","inline". Empty list

// defaults to "file","inline" and "none" disables lua

// filters.

LuaSources []string

EnableOpenPolicyAgent bool

OpenPolicyAgentConfigTemplate string

OpenPolicyAgentEnvoyMetadata string

OpenPolicyAgentCleanerInterval time.Duration

OpenPolicyAgentStartupTimeout time.Duration

OpenPolicyAgentMaxRequestBodySize int64

OpenPolicyAgentMaxMemoryBodyParsing int64

PassiveHealthCheck map[string]string

return kubernetes.Options{

AllowedExternalNames: o.KubernetesAllowedExternalNames,

BackendNameTracingTag: o.OpenTracingBackendNameTag,

DefaultFiltersDir: o.DefaultFiltersDir,

KubernetesInCluster: o.KubernetesInCluster,

KubernetesURL: o.KubernetesURL,

TokenFile: o.KubernetesTokenFile,

KubernetesNamespace: o.KubernetesNamespace,

KubernetesEnableEastWest: o.KubernetesEnableEastWest,

KubernetesEnableEndpointslices: o.KubernetesEnableEndpointslices,

KubernetesEastWestDomain: o.KubernetesEastWestDomain,

KubernetesEastWestRangeDomains: o.KubernetesEastWestRangeDomains,

KubernetesEastWestRangePredicates: o.KubernetesEastWestRangePredicates,

HTTPSRedirectCode: o.KubernetesHTTPSRedirectCode,

DisableCatchAllRoutes: o.KubernetesDisableCatchAllRoutes,

IngressClass: o.KubernetesIngressClass,

IngressLabelSelectors: o.KubernetesIngressLabelSelectors,

ServicesLabelSelectors: o.KubernetesServicesLabelSelectors,

EndpointsLabelSelectors: o.KubernetesEndpointsLabelSelectors,

SecretsLabelSelectors: o.KubernetesSecretsLabelSelectors,

RouteGroupsLabelSelectors: o.KubernetesRouteGroupsLabelSelectors,

OnlyAllowedExternalNames: o.KubernetesOnlyAllowedExternalNames,

OriginMarker: o.EnableRouteCreationMetrics,

PathMode: o.KubernetesPathMode,

ProvideHealthcheck: o.KubernetesHealthcheck,

ProvideHTTPSRedirect: o.KubernetesHTTPSRedirect,

ReverseSourcePredicate: o.ReverseSourcePredicate,

RouteGroupClass: o.KubernetesRouteGroupClass,

WhitelistedHealthCheckCIDR: o.WhitelistedHealthCheckCIDR,

ForceKubernetesService: o.KubernetesForceService,

BackendTrafficAlgorithm: o.KubernetesBackendTrafficAlgorithm,

DefaultLoadBalancerAlgorithm: o.KubernetesDefaultLoadBalancerAlgorithm,

}

oauthConfig := &auth.OAuthConfig{}

oauthConfig.AuthURL = o.OAuth2AuthURL

oauthConfig.TokenURL = o.OAuth2TokenURL

oauthConfig.RevokeTokenURL = o.OAuth2RevokeTokenURL

oauthConfig.TokeninfoURL = o.OAuthTokeninfoURL

oauthConfig.SecretFile = o.OAuth2SecretFile

oauthConfig.ClientID = o.OAuth2ClientID

oauthConfig.ClientSecret = o.OAuth2ClientSecret

oauthConfig.ClientIDFile = o.OAuth2ClientIDFile

oauthConfig.ClientSecretFile = o.OAuth2ClientSecretFile

oauthConfig.CallbackPath = o.OAuth2CallbackPath

oauthConfig.AuthURLParameters = o.OAuth2AuthURLParameters

oauthConfig.Secrets = o.SecretsRegistry

oauthConfig.AccessTokenHeaderName = o.OAuth2AccessTokenHeaderName

oauthConfig.TokeninfoSubjectKey = o.OAuth2TokeninfoSubjectKey

oauthConfig.GrantTokeninfoKeys = o.OAuth2GrantTokeninfoKeys

oauthConfig.TokenCookieName = o.OAuth2TokenCookieName

oauthConfig.TokenCookieRemoveSubdomains = &o.OAuth2TokenCookieRemoveSubdomains

oauthConfig.Insecure = o.OAuth2GrantInsecure

oauthConfig.ConnectionTimeout = o.OAuthTokeninfoTimeout

oauthConfig.MaxIdleConnectionsPerHost = o.IdleConnectionsPerHost

return oauthConfig

m := string(p)

if strings.HasPrefix(m, "http: TLS handshake error") && strings.HasSuffix(m, ": EOF\n") {

log.Debug(m) // https://github.com/golang/go/issues/26918

} else if strings.HasPrefix(m, "http: URL query contains semicolon") {

log.Debug(m) // https://github.com/golang/go/issues/25192

} else {

log.Error(m)