REST Resource: projects.locations.clientTlsPolicies

{
  "name": string,
  "description": string,
  "createTime": string,
  "updateTime": string,
  "labels": {
    string: string,
    ...
  },
  "sni": string,
  "clientCertificate": {
    object (CertificateProvider)
  },
  "serverValidationCa": [
    {
      object (ValidationCA)
    }
  ],
  "targets": [
    string
  ],
  "workloadContextSelectors": [
    {
      object (WorkloadContextSelector)
    }
  ],
  "subjectAltNames": [
    string
  ],
  "internalCaller": boolean
}

string

Required. Name of the ClientTlsPolicy resource. It matches the pattern projects/*/locations/{location}/clientTlsPolicies/{clientTlsPolicy}

string

Optional. Free-text description of the resource.

string (Timestamp format)

Output only. The timestamp when the resource was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

string (Timestamp format)

Output only. The timestamp when the resource was updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

map (key: string, value: string)

Optional. Set of label tags associated with the resource.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

string

Optional. Server Name Indication string to present to the server during TLS handshake. E.g: "secure.example.com".

object (CertificateProvider)

Optional. Defines a mechanism to provision client identity (public and private keys) for peer to peer authentication. The presence of this dictates mTLS.

object (ValidationCA)

Optional. Defines the mechanism to obtain the Certificate Authority certificate to validate the server certificate. If empty, client does not validate the server certificate.

string

Optional. Define a list of targets this policy should serve. A target can only be a BackendService and it should be the fully qualified name of the BackendService, e.g.: projects/xxx/backendServices/locations/global/xxx NOTE: ClientTlsPolicy and the referenced BackendServices must be present in the same project. This is used only for Google Service Mesh (GSM) product.

object (WorkloadContextSelector)

Optional. Selects the workload where the policy should be applied to its targets. A policy without a WorkloadContextSelector should always be applied to its targets when there is no conflict. If there are multiple WorkloadContextSelectors then the policy will be applied to all targets if ANY of the WorkloadContextSelectors match. Therefore these selectors can be combined in an OR fashion.

If there are multiple ClientTlsPolicy targeted to the same BackendService, There should be only one effective ClientTlsPolicy and the precdence is as following: 1) ClientTlsPolicy with workloadContextSelectors will take precedence first. 2) If there are multiple ClientTlsPolicy with workloadContextSelectors matched, earliest created one will take take precedence. 3) Then ClientTlsPolicy without workloadSelector will take precedence. Right now we don't allow multiple ClientTlsPolicy without workloadSelector attached the same backendService.

NOTE: For GSM use only.

string

Optional. A list of alternate names to verify the server identity in the certificate. If specified, the client will verify that the server certificate’s subject alt name matches one of the specified values. If specified, this list overrides the value of subjectAltNames from the BackendService.securitySettings.subjectAltNames[]. The domain names can be either be exact match (e.g foo) or suffix matches (e.g foo* or foo/*)

boolean

Optional. A flag set to identify internal controllers Setting this will trigger a P4SA check to validate the caller is from an allowlisted service's P4SA even if other optional fields are unset.

{
  "metadataSelectors": [
    {
      object (MetadataSelector)
    }
  ]
}

object (MetadataSelector)

Required. A map of metadata label values used to select workloads. If multiple MetadataSelectors are provided, all MetadataSelectors must match in order for the policy to be applied to this workload. Therefore these selectors must be combined in an AND fashion.

{
  "key": string,
  "value": string
}

string

Required. The metadata field being selected on

string

Required. The value for this metadata field to be compared with