1apiVersion: compute.gcp.m.upbound.io/v1beta1
2kind: SecurityPolicy
SecurityPolicySpec defines the desired state of SecurityPolicy
(No description available)
Configuration for Google Cloud Armor Adaptive Protection. Structure is documented below.
Configuration for Google Cloud Armor Adaptive Protection Layer 7 DDoS Defense. Structure is documented below.
Configuration options for layer7 adaptive protection for various customizable thresholds. Structure is documented below.
Configuration options for enabling Adaptive Protection to work on the specified service granularity. Structure is documented below.
Advanced Configuration Options. Structure is documented below.
Custom configuration to apply the JSON parsing. Only applicable when json_parsing is set to STANDARD. Structure is documented below.
A list of custom Content-Type header values to apply the JSON parsing. The format of the Content-Type header values is defined in RFC 1341. When configuring a custom Content-Type header value, only the type/subtype needs to be specified, and the parameters should be excluded.
An optional list of case-insensitive request header names to use for resolving the callers client IP address.
reCAPTCHA Configuration Options. Structure is documented below.
The set of rules that belong to this policy. There must always be a default rule (rule with priority 2147483647 and match "*"). If no rules are provided when creating a security policy, a default rule with action "allow" will be added. Structure is documented below.
Additional actions that are performed on headers. Structure is documented below.
The list of request headers to add or overwrite if they're already present. Structure is documented below.
A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding action is enforced. Structure is documented below.
The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified. Structure is documented below.
Set of IP addresses or ranges (IPV4 or IPV6) in CIDR notation to match against inbound traffic. There is a limit of 10 IP ranges per rule. A value of * matches all IPs (can be used to override the default behavior).
User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Structure is documented below.
The configuration options available when specifying a user defined CEVAL expression (i.e., 'expr'). Structure is documented below.
reCAPTCHA configuration options to be applied for the rule. If the rule does not evaluate reCAPTCHA tokens, this field has no effect. Structure is documented below.
A list of site keys to be used during the validation of reCAPTCHA action-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
A list of site keys to be used during the validation of reCAPTCHA session-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect. Structure is documented below.
An exclusion to apply during preconfigured WAF evaluation. Structure is documented below.
A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion. If omitted, it refers to all the rule IDs under the WAF rule set.
Must be specified if the action is rate_based_ban or throttle. Cannot be specified for other actions. Structure is documented below.
Can only be specified if the action for the rule is rate_based_ban. If specified, the key will be banned for the configured ban_duration_sec when the number of requests that exceed the rate_limit_threshold also exceed this ban_threshold. Structure is documented below.
If specified, any combination of values of enforce_on_key_type/enforce_on_key_name is treated as the key on which rate limit threshold/action is enforced. You can specify up to 3 enforce_on_key_configs. If enforce_on_key_configs is specified, enforce_on_key must be set to an empty string. Structure is documented below.
Threshold at which to begin ratelimiting. Structure is documented below.
THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.
Configuration for Google Cloud Armor Adaptive Protection. Structure is documented below.
Configuration for Google Cloud Armor Adaptive Protection Layer 7 DDoS Defense. Structure is documented below.
Configuration options for layer7 adaptive protection for various customizable thresholds. Structure is documented below.
Configuration options for enabling Adaptive Protection to work on the specified service granularity. Structure is documented below.
Advanced Configuration Options. Structure is documented below.
Custom configuration to apply the JSON parsing. Only applicable when json_parsing is set to STANDARD. Structure is documented below.
A list of custom Content-Type header values to apply the JSON parsing. The format of the Content-Type header values is defined in RFC 1341. When configuring a custom Content-Type header value, only the type/subtype needs to be specified, and the parameters should be excluded.
An optional list of case-insensitive request header names to use for resolving the callers client IP address.
reCAPTCHA Configuration Options. Structure is documented below.
The set of rules that belong to this policy. There must always be a default rule (rule with priority 2147483647 and match "*"). If no rules are provided when creating a security policy, a default rule with action "allow" will be added. Structure is documented below.
Additional actions that are performed on headers. Structure is documented below.
The list of request headers to add or overwrite if they're already present. Structure is documented below.
A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding action is enforced. Structure is documented below.
The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified. Structure is documented below.
Set of IP addresses or ranges (IPV4 or IPV6) in CIDR notation to match against inbound traffic. There is a limit of 10 IP ranges per rule. A value of * matches all IPs (can be used to override the default behavior).
User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Structure is documented below.
The configuration options available when specifying a user defined CEVAL expression (i.e., 'expr'). Structure is documented below.
reCAPTCHA configuration options to be applied for the rule. If the rule does not evaluate reCAPTCHA tokens, this field has no effect. Structure is documented below.
A list of site keys to be used during the validation of reCAPTCHA action-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
A list of site keys to be used during the validation of reCAPTCHA session-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect. Structure is documented below.
An exclusion to apply during preconfigured WAF evaluation. Structure is documented below.
A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion. If omitted, it refers to all the rule IDs under the WAF rule set.
Must be specified if the action is rate_based_ban or throttle. Cannot be specified for other actions. Structure is documented below.
Can only be specified if the action for the rule is rate_based_ban. If specified, the key will be banned for the configured ban_duration_sec when the number of requests that exceed the rate_limit_threshold also exceed this ban_threshold. Structure is documented below.
If specified, any combination of values of enforce_on_key_type/enforce_on_key_name is treated as the key on which rate limit threshold/action is enforced. You can specify up to 3 enforce_on_key_configs. If enforce_on_key_configs is specified, enforce_on_key must be set to an empty string. Structure is documented below.
Threshold at which to begin ratelimiting. Structure is documented below.
THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.
SecurityPolicyStatus defines the observed state of SecurityPolicy.
(No description available)
Configuration for Google Cloud Armor Adaptive Protection. Structure is documented below.
Configuration for Google Cloud Armor Adaptive Protection Layer 7 DDoS Defense. Structure is documented below.
Configuration options for layer7 adaptive protection for various customizable thresholds. Structure is documented below.
Configuration options for enabling Adaptive Protection to work on the specified service granularity. Structure is documented below.
Advanced Configuration Options. Structure is documented below.
Custom configuration to apply the JSON parsing. Only applicable when json_parsing is set to STANDARD. Structure is documented below.
A list of custom Content-Type header values to apply the JSON parsing. The format of the Content-Type header values is defined in RFC 1341. When configuring a custom Content-Type header value, only the type/subtype needs to be specified, and the parameters should be excluded.
An optional list of case-insensitive request header names to use for resolving the callers client IP address.
reCAPTCHA Configuration Options. Structure is documented below.
The set of rules that belong to this policy. There must always be a default rule (rule with priority 2147483647 and match "*"). If no rules are provided when creating a security policy, a default rule with action "allow" will be added. Structure is documented below.
Additional actions that are performed on headers. Structure is documented below.
The list of request headers to add or overwrite if they're already present. Structure is documented below.
A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding action is enforced. Structure is documented below.
The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified. Structure is documented below.
Set of IP addresses or ranges (IPV4 or IPV6) in CIDR notation to match against inbound traffic. There is a limit of 10 IP ranges per rule. A value of * matches all IPs (can be used to override the default behavior).
User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Structure is documented below.
The configuration options available when specifying a user defined CEVAL expression (i.e., 'expr'). Structure is documented below.
reCAPTCHA configuration options to be applied for the rule. If the rule does not evaluate reCAPTCHA tokens, this field has no effect. Structure is documented below.
A list of site keys to be used during the validation of reCAPTCHA action-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
A list of site keys to be used during the validation of reCAPTCHA session-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect. Structure is documented below.
An exclusion to apply during preconfigured WAF evaluation. Structure is documented below.
A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion. If omitted, it refers to all the rule IDs under the WAF rule set.
Must be specified if the action is rate_based_ban or throttle. Cannot be specified for other actions. Structure is documented below.
Can only be specified if the action for the rule is rate_based_ban. If specified, the key will be banned for the configured ban_duration_sec when the number of requests that exceed the rate_limit_threshold also exceed this ban_threshold. Structure is documented below.
If specified, any combination of values of enforce_on_key_type/enforce_on_key_name is treated as the key on which rate limit threshold/action is enforced. You can specify up to 3 enforce_on_key_configs. If enforce_on_key_configs is specified, enforce_on_key must be set to an empty string. Structure is documented below.
Threshold at which to begin ratelimiting. Structure is documented below.
Conditions of the resource.