The MeshTrafficPermission API from Kuma — 2 operation(s) for meshtrafficpermission.
openapi: 3.1.0
info:
title: Kuma Dataplane MeshTrafficPermission API
description: Kuma API
version: v1alpha1
x-ref-schema-name: DataplaneOverview
security:
- BasicAuth: []
- BearerAuth: []
- {}
tags:
- name: MeshTrafficPermission
paths:
/meshes/{mesh}/meshtrafficpermissions/{name}:
get:
operationId: getMeshTrafficPermission
summary: Returns MeshTrafficPermission entity
tags:
- MeshTrafficPermission
parameters:
- in: path
name: mesh
schema:
type: string
required: true
description: name of the mesh
- in: path
name: name
schema:
type: string
required: true
description: name of the MeshTrafficPermission
responses:
'200':
$ref: '#/components/responses/MeshTrafficPermissionItem'
'404':
$ref: '#/components/responses/NotFound'
put:
operationId: putMeshTrafficPermission
summary: Creates or Updates MeshTrafficPermission entity
tags:
- MeshTrafficPermission
parameters:
- in: path
name: mesh
schema:
type: string
required: true
description: name of the mesh
- in: path
name: name
schema:
type: string
required: true
description: name of the MeshTrafficPermission
requestBody:
description: Put request
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/MeshTrafficPermissionItem'
responses:
'200':
$ref: '#/components/responses/MeshTrafficPermissionCreateOrUpdateSuccessResponse'
'201':
$ref: '#/components/responses/MeshTrafficPermissionCreateOrUpdateSuccessResponse'
delete:
operationId: deleteMeshTrafficPermission
summary: Deletes MeshTrafficPermission entity
tags:
- MeshTrafficPermission
parameters:
- in: path
name: mesh
schema:
type: string
required: true
description: name of the mesh
- in: path
name: name
schema:
type: string
required: true
description: name of the MeshTrafficPermission
responses:
'200':
$ref: '#/components/responses/MeshTrafficPermissionDeleteSuccessResponse'
'404':
$ref: '#/components/responses/NotFound'
/meshes/{mesh}/meshtrafficpermissions:
get:
operationId: getMeshTrafficPermissionList
summary: Returns a list of MeshTrafficPermission in the mesh.
tags:
- MeshTrafficPermission
parameters:
- in: query
name: offset
description: offset in the list of entities
required: false
schema:
type: integer
example: 0
- in: query
name: size
description: the number of items per page
required: false
schema:
type: integer
default: 100
maximum: 1000
minimum: 1
- in: query
name: filter
description: filter by labels when multiple filters are present, they are ANDed
required: false
schema:
type: object
properties:
key:
type: string
value:
type: string
example:
label.k8s.kuma.io/namespace: my-ns
- in: path
name: mesh
schema:
type: string
required: true
description: name of the mesh
responses:
'200':
$ref: '#/components/responses/MeshTrafficPermissionList'
components:
responses:
NotFound:
description: Not Found
content:
application/problem+json:
schema:
$ref: '#/components/schemas/NotFoundError'
MeshTrafficPermissionItem:
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/MeshTrafficPermissionItem'
MeshTrafficPermissionDeleteSuccessResponse:
description: Successful response
content:
application/json:
schema:
type: object
MeshTrafficPermissionList:
description: List
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
$ref: '#/components/schemas/MeshTrafficPermissionItem'
total:
type: number
description: The total number of entities
next:
type: string
description: URL to the next page
MeshTrafficPermissionCreateOrUpdateSuccessResponse:
description: Successful response
content:
application/json:
schema:
type: object
properties:
warnings:
type: array
readOnly: true
description: 'warnings is a list of warning messages to return to the requesting Kuma API clients.
Warning messages describe a problem the client making the API request should correct or be aware of.
'
items:
type: string
schemas:
NotFoundError:
allOf:
- $ref: '#/components/schemas/Error'
- type: object
properties:
status:
type: integer
enum:
- 404
example: 404
description: 'The HTTP status code for NotFoundError MUST be 404.
'
title:
type: string
example: Not Found
type:
type: string
example: https://httpstatuses.com/404
detail:
type: string
example: The requested resource was not found
InvalidParameters:
type: object
title: Invalid Parameters
required:
- field
- reason
- source
properties:
field:
type: string
description: The name of the field that caused the error.
reason:
type: string
description: 'A short, human-readable description of the problem.
_Should_ be provided as "Sentence case" for direct use in a UI.
'
rule:
type: string
description: 'May be provided as a hint to the user to help understand the type of failure.
Additional guidance may be provided in additional fields, i.e. `choices`.
'
choices:
type: array
description: 'Optional field to provide a list of valid choices for the field that caused the error.
'
items:
type: string
source:
type: string
description: 'The location of the field that caused the error.
'
enum:
- body
- query
- header
- path
MeshTrafficPermissionItem:
type: object
description: MeshTrafficPermission controls which services are allowed to communicate with each other in the mesh. It provides fine-grained access control by allowing you to define allow/deny rules based on service identity, enabling zero-trust security and supporting shadow mode for testing permission changes before enforcement.
required:
- type
- name
- spec
properties:
type:
description: the type of the resource
type: string
enum:
- MeshTrafficPermission
mesh:
description: Mesh is the name of the Kuma mesh this resource belongs to. It may be omitted for cluster-scoped resources.
type: string
default: default
kri:
description: A unique identifier for this resource instance used by internal tooling and integrations. Typically derived from resource attributes and may be used for cross-references or indexing
type: string
readOnly: true
example: kri_mtp_default_zone-east_kuma-demo_mypolicy1_
name:
description: Name of the Kuma resource
type: string
labels:
additionalProperties:
type: string
description: The labels to help identity resources
type: object
spec:
description: Spec is the specification of the Kuma MeshTrafficPermission resource.
properties:
from:
description: From list makes a match between clients and corresponding configurations
items:
properties:
default:
description: 'Default is a configuration specific to the group of clients referenced in
''targetRef'''
properties:
action:
description: 'Action defines a behavior for the specified group of clients:'
enum:
- Allow
- Deny
- AllowWithShadowDeny
type: string
type: object
targetRef:
description: 'TargetRef is a reference to the resource that represents a group of
clients.'
properties:
kind:
description: Kind of the referenced resource
enum:
- Mesh
- MeshSubset
- MeshGateway
- MeshService
- MeshExternalService
- MeshMultiZoneService
- MeshServiceSubset
- MeshHTTPRoute
- Dataplane
type: string
labels:
additionalProperties:
type: string
description: 'Labels are used to select group of MeshServices that match labels. Either Labels or
Name and Namespace can be used.'
type: object
mesh:
description: Mesh is reserved for future use to identify cross mesh resources.
type: string
name:
description: 'Name of the referenced resource. Can only be used with kinds: `MeshService`,
`MeshServiceSubset` and `MeshGatewayRoute`'
type: string
namespace:
description: 'Namespace specifies the namespace of target resource. If empty only resources in policy namespace
will be targeted.'
type: string
proxyTypes:
description: 'ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
all data plane types are targeted by the policy.'
items:
enum:
- Sidecar
- Gateway
type: string
type: array
sectionName:
description: 'SectionName is used to target specific section of resource.
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.'
type: string
tags:
additionalProperties:
type: string
description: 'Tags used to select a subset of proxies by tags. Can only be used with kinds
`MeshSubset` and `MeshServiceSubset`'
type: object
required:
- kind
type: object
required:
- targetRef
type: object
type: array
rules:
description: Rules defines inbound permissions configuration
items:
properties:
default:
properties:
allow:
description: Allow definees a list of matches for which access will be allowed
items:
properties:
spiffeID:
description: SpiffeID defines a matcher configuration for SpiffeID matching
properties:
type:
description: Type defines how to match incoming traffic by SpiffeID. `Exact` or `Prefix` are allowed.
enum:
- Exact
- Prefix
type: string
value:
description: Value is SpiffeId of a client that needs to match for the configuration to be applied
type: string
required:
- type
- value
type: object
type: object
type: array
allowWithShadowDeny:
description: 'AllowWithShadowDeny defines a list of matches for which access will be allowed but emits logs as if
requests are denied'
items:
properties:
spiffeID:
description: SpiffeID defines a matcher configuration for SpiffeID matching
properties:
type:
description: Type defines how to match incoming traffic by SpiffeID. `Exact` or `Prefix` are allowed.
enum:
- Exact
- Prefix
type: string
value:
description: Value is SpiffeId of a client that needs to match for the configuration to be applied
type: string
required:
- type
- value
type: object
type: object
type: array
deny:
description: Deny defines a list of matches for which access will be denied
items:
properties:
spiffeID:
description: SpiffeID defines a matcher configuration for SpiffeID matching
properties:
type:
description: Type defines how to match incoming traffic by SpiffeID. `Exact` or `Prefix` are allowed.
enum:
- Exact
- Prefix
type: string
value:
description: Value is SpiffeId of a client that needs to match for the configuration to be applied
type: string
required:
- type
- value
type: object
type: object
type: array
type: object
required:
- default
type: object
type: array
targetRef:
description: 'TargetRef is a reference to the resource the policy takes an effect on.
The resource could be either a real store object or virtual resource
defined inplace.'
properties:
kind:
description: Kind of the referenced resource
enum:
- Mesh
- MeshSubset
- MeshGateway
- MeshService
- MeshExternalService
- MeshMultiZoneService
- MeshServiceSubset
- MeshHTTPRoute
- Dataplane
type: string
labels:
additionalProperties:
type: string
description: 'Labels are used to select group of MeshServices that match labels. Either Labels or
Name and Namespace can be used.'
type: object
mesh:
description: Mesh is reserved for future use to identify cross mesh resources.
type: string
name:
description: 'Name of the referenced resource. Can only be used with kinds: `MeshService`,
`MeshServiceSubset` and `MeshGatewayRoute`'
type: string
namespace:
description: 'Namespace specifies the namespace of target resource. If empty only resources in policy namespace
will be targeted.'
type: string
proxyTypes:
description: 'ProxyTypes specifies the data plane types that are subject to the policy. When not specified,
all data plane types are targeted by the policy.'
items:
enum:
- Sidecar
- Gateway
type: string
type: array
sectionName:
description: 'SectionName is used to target specific section of resource.
For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.'
type: string
tags:
additionalProperties:
type: string
description: 'Tags used to select a subset of proxies by tags. Can only be used with kinds
`MeshSubset` and `MeshServiceSubset`'
type: object
required:
- kind
type: object
type: object
creationTime:
readOnly: true
type: string
description: Time at which the resource was created
format: date-time
example: '0001-01-01T00:00:00Z'
modificationTime:
readOnly: true
type: string
description: Time at which the resource was updated
format: date-time
example: '0001-01-01T00:00:00Z'
Error:
type: object
title: Error
description: 'Standard error. Follows the [AIP #193 - Errors](https://kong-aip.netlify.app/aip/193/) specification.
'
x-examples:
Example 1:
status: 404
title: Not Found
type: https://kongapi.info/konnect/not-found
instance: portal:trace:2287285207635123011
detail: The requested document was not found
required:
- status
- title
- instance
- type
- detail
properties:
status:
type: integer
description: The HTTP status code.
example: 404
title:
type: string
description: 'A short, human-readable summary of the problem.
It **should not** change between occurrences of a problem, except for localization.
Should be provided as "Sentence case" for potential direct use in a UI
'
example: Not Found
type:
type: string
description: 'A unique identifier for this error. When dereferenced it must provide human-readable documentation for the problem.
'
example: Not Found
instance:
type: string
example: portal:trace:2287285207635123011
description: 'Used to return the correlation ID back to the user, in the format `<app>:trace:<correlation_id>`.
'
detail:
type: string
example: The requested team was not found
description: 'A human readable explanation specific to this occurrence of the problem.
This field may contain request/entity data to help the user understand what went wrong.
Enclose variable values in square brackets.
_Should_ be provided as "Sentence case" for direct use in a UI
'
invalid_parameters:
type: array
description: 'All 400 errors **MUST** return an `invalid_parameters` key in the response.
Used to indicate which fields have invalid values when validated.
'
items:
$ref: '#/components/schemas/InvalidParameters'
securitySchemes:
BasicAuth:
type: http
scheme: basic
BearerAuth:
type: http
scheme: bearer