Summary

Example object

Fields

name

Header key to match on. Supports regex expressions.

value

Header value to match on. Supports regex expressions.

case_sensitive

If true, then the regex matching will be case sensitive. Defaults to false.

invert

If true, invert the regex match. This allows easier "not" expressions.

For example, to match only X-Forwarded-Proto: "http":

But to match anything NOT "https":

Summary

Redirects specify how URLs may need to be rewritten. Each Redirect has a name, a regex that matches the requested URL, a to indicating how the url should be rewritten, and a flag to indicate how the redirect will be handled by the proxying layer.

Example object

Fields

name

Common name for this redirect, e.g. "force-https".

from

Regex pattern to match against incoming request URLs. Capture groups set here can be used in the field.

to

New URL of the redirect. Can be direct string (") or reference capture groups from the field ("").

redirect_type

One of "permanent" or "temporary". Selection "permanent" will set the response code to 301, "temporary" will be 302.

header_constraints

Array of that must match for the redirect to take effect.

Summary

Grey Matter supports the configuration of cross-origin resource sharing on a sidecar. CORS can be configured to allow an application to access resources at a different origin (domain, protocol, or port) than its own.

For more information on CORS, see this .

Summary

Example object

Fields

cipher_filter

. If specified, only the listed ciphers will be accepted. Only valid with TLSv1-TLSv1.2, but has no affect with TLSv1.3.

Examples include the values below, but full options should be found in the link above.

• [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]

• [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]

• ECDHE-ECDSA-AES128-SHA

protocols

Array of SSL protocols to accept: "TLSv1, TLSv1.1, TLSv1.2, TLSv1.3"

cert_key_pairs

Array of (cert, key) pairs to use when receiving requests on this . Each cert or key must point to files on disk.

require_client_certs

If true, client cert verification will be performed. false will disable this check and not require client certificates to be presented when connecting to this listener.

trust_file

String representing the path on disk to the SSL trust file to use when receiving requests on this . If omitted, then no trust verification will be performed.

sni

String representing how this listener will identify itself during SSL SNI.

Summary

Each domain controls requests for a specific host:port. This permits different handling of requests to domains like localhost:8080 or catalog:8080 if desired. If uniform handling is required, wildcards are understood to apply to all domains. A domain set to match *:8080 will match both of the above domains.

NOTEThe domain port should, in most cases, match the port of the exposed on the proxy. If they do not match, users will need to supply HOST: header keywords to all requests to match the virtual domain.

Features

• Virtual host:port matching and redirecting

• GZIP of requests

• CORS

Example Object

TLS Configuration

NOTE Do not set an ssl_config on any domain object whose service you want to use SPIFFE/SPIRE. If a domain ssl_config is set, it will override the secret set on the corresponding listener and the mesh configuration will be wrong.

The domain object has an optional ssl_config field, which can be used to set up TLS and specify it's configuration. The Domain SSL Config Object appears as follows:

The Domain SSL Configuration is used to populate a for the Envoy Listener.

The sni field for a domain accepts a list of strings and configures the Envoy Listener to detect the requested Server Name Indication.

To specify a minimum and maximum TLS protocol version, set the protocols field to one of the following: "TLSv1_0", "TLSv1_1", "TLSv1_2", "TLSv1_3". If one protocol is specified, it will be set as both the minimum and maximum protocol versions in Envoy. If more than one protocol version is specified in the list, the lowest will set the minimum TLS protocol version and the highest will set the maximum TLS protocol version. If this field is left empty, Envoy will choose the default TLS version.

The cipher_filter field takes a colon : delimited string to populate the cipher_suites cipher list in envoy for TLS.

redirects

This field can be used to configure redirect routes for the domain. See for details.

Fields:

• name

  • the name of the redirect

• from

Envoy Reference

Fields

domain_key

A unique key used to identify this particular domain configuration. This key is used in proxy, listener, and route objects.

zone_key

The zone in which this object will live. It will only be able to be referenced by objects or sent to Sidecars that live in the same zone.

name

The name of this virtual domain, e.g. localhost, www.greymatter.io, or catalog.svc.local. Only requests coming in to the named host will be matched and handled by attached . Is used in conjunction with the field.

This field can be set to a wildcard (*) which will match against all hostnames.

port

Set the specific port of the virtual host to match. Is used in conjunction with the field.

E.g. port: 8080 and name: * will setup a virtual domain matching any request made to port 8080 regardless of the host.

ssl_config

for this cluster. Setting the SSL Config at the domain level set this same config on all that are directly linked to this domain.

redirects

Array of URL

gzip_enabled

DEPRECATION: This field has been deprecated and will be removed in the next major version release.

This field has no effect.

cors_config

A to attach to this domain.

aliases

An array of additional hostnames that should be matched in this domain. E.g. name: "www.greymatter.io" with aliases: ["greymatter.io", "localhost"]

force_https

If true, listeners attached to this domain will only accept HTTPS connections. In this case, one of the or fields should be set. If false, attached listeners will only accept plaintext HTTP connections.

custom_headers

An array of header key, value pairs to set on all requests that pass through this domain.

E.g.

checksum

An API calculated checksum. Can be used to verify that the API contains the expected object before performing a write.