Class Validation.Builder
java.lang.Object
com.google.protobuf.AbstractMessageLite.Builder
com.google.protobuf.AbstractMessage.Builder<BuilderT>
com.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
io.envoyproxy.envoy.extensions.filters.network.reverse_tunnel.v3.Validation.Builder
- All Implemented Interfaces:
com.google.protobuf.Message.Builder,com.google.protobuf.MessageLite.Builder,com.google.protobuf.MessageLiteOrBuilder,com.google.protobuf.MessageOrBuilder,ValidationOrBuilder,Cloneable
- Enclosing class:
- Validation
public static final class Validation.Builder
extends com.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
implements ValidationOrBuilder
Validation configuration for reverse tunnel identifiers. Validates the node ID and cluster ID extracted from reverse tunnel handshake headers against expected values specified using format strings.Protobuf type
envoy.extensions.filters.network.reverse_tunnel.v3.Validation-
Method Summary
Modifier and TypeMethodDescriptionaddRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field, Object value) build()clear()Format string to extract the expected cluster identifier for validation.Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``.Whether to emit validation results as dynamic metadata.clearField(com.google.protobuf.Descriptors.FieldDescriptor field) Format string to extract the expected node identifier for validation.clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) clone()Format string to extract the expected cluster identifier for validation.com.google.protobuf.ByteStringFormat string to extract the expected cluster identifier for validation.static final com.google.protobuf.Descriptors.Descriptorcom.google.protobuf.Descriptors.DescriptorNamespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``.com.google.protobuf.ByteStringNamespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``.booleanWhether to emit validation results as dynamic metadata.Format string to extract the expected node identifier for validation.com.google.protobuf.ByteStringFormat string to extract the expected node identifier for validation.protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTablefinal booleanmergeFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) mergeFrom(com.google.protobuf.Message other) mergeFrom(Validation other) final Validation.BuildermergeUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields) setClusterIdFormat(String value) Format string to extract the expected cluster identifier for validation.setClusterIdFormatBytes(com.google.protobuf.ByteString value) Format string to extract the expected cluster identifier for validation.Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``.setDynamicMetadataNamespaceBytes(com.google.protobuf.ByteString value) Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``.setEmitDynamicMetadata(boolean value) Whether to emit validation results as dynamic metadata.setNodeIdFormat(String value) Format string to extract the expected node identifier for validation.setNodeIdFormatBytes(com.google.protobuf.ByteString value) Format string to extract the expected node identifier for validation.setRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field, int index, Object value) final Validation.BuildersetUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields) Methods inherited from class com.google.protobuf.GeneratedMessageV3.Builder
getAllFields, getField, getFieldBuilder, getOneofFieldDescriptor, getParentForChildren, getRepeatedField, getRepeatedFieldBuilder, getRepeatedFieldCount, getUnknownFields, getUnknownFieldSetBuilder, hasField, hasOneof, internalGetMapField, internalGetMapFieldReflection, internalGetMutableMapField, internalGetMutableMapFieldReflection, isClean, markClean, mergeUnknownLengthDelimitedField, mergeUnknownVarintField, newBuilderForField, onBuilt, onChanged, parseUnknownField, setUnknownFieldSetBuilder, setUnknownFieldsProto3Methods inherited from class com.google.protobuf.AbstractMessage.Builder
findInitializationErrors, getInitializationErrorString, internalMergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, mergeFrom, newUninitializedMessageException, toStringMethods inherited from class com.google.protobuf.AbstractMessageLite.Builder
addAll, addAll, mergeDelimitedFrom, mergeDelimitedFrom, mergeFrom, newUninitializedMessageExceptionMethods inherited from class java.lang.Object
equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, waitMethods inherited from interface com.google.protobuf.Message.Builder
mergeDelimitedFrom, mergeDelimitedFromMethods inherited from interface com.google.protobuf.MessageLite.Builder
mergeFromMethods inherited from interface com.google.protobuf.MessageOrBuilder
findInitializationErrors, getAllFields, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof
-
Method Details
-
getDescriptor
public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() -
internalGetFieldAccessorTable
protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()- Specified by:
internalGetFieldAccessorTablein classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
clear
- Specified by:
clearin interfacecom.google.protobuf.Message.Builder- Specified by:
clearin interfacecom.google.protobuf.MessageLite.Builder- Overrides:
clearin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
getDescriptorForType
public com.google.protobuf.Descriptors.Descriptor getDescriptorForType()- Specified by:
getDescriptorForTypein interfacecom.google.protobuf.Message.Builder- Specified by:
getDescriptorForTypein interfacecom.google.protobuf.MessageOrBuilder- Overrides:
getDescriptorForTypein classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
getDefaultInstanceForType
- Specified by:
getDefaultInstanceForTypein interfacecom.google.protobuf.MessageLiteOrBuilder- Specified by:
getDefaultInstanceForTypein interfacecom.google.protobuf.MessageOrBuilder
-
build
- Specified by:
buildin interfacecom.google.protobuf.Message.Builder- Specified by:
buildin interfacecom.google.protobuf.MessageLite.Builder
-
buildPartial
- Specified by:
buildPartialin interfacecom.google.protobuf.Message.Builder- Specified by:
buildPartialin interfacecom.google.protobuf.MessageLite.Builder
-
clone
- Specified by:
clonein interfacecom.google.protobuf.Message.Builder- Specified by:
clonein interfacecom.google.protobuf.MessageLite.Builder- Overrides:
clonein classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
setField
public Validation.Builder setField(com.google.protobuf.Descriptors.FieldDescriptor field, Object value) - Specified by:
setFieldin interfacecom.google.protobuf.Message.Builder- Overrides:
setFieldin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
clearField
- Specified by:
clearFieldin interfacecom.google.protobuf.Message.Builder- Overrides:
clearFieldin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
clearOneof
- Specified by:
clearOneofin interfacecom.google.protobuf.Message.Builder- Overrides:
clearOneofin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
setRepeatedField
public Validation.Builder setRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field, int index, Object value) - Specified by:
setRepeatedFieldin interfacecom.google.protobuf.Message.Builder- Overrides:
setRepeatedFieldin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
addRepeatedField
public Validation.Builder addRepeatedField(com.google.protobuf.Descriptors.FieldDescriptor field, Object value) - Specified by:
addRepeatedFieldin interfacecom.google.protobuf.Message.Builder- Overrides:
addRepeatedFieldin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
mergeFrom
- Specified by:
mergeFromin interfacecom.google.protobuf.Message.Builder- Overrides:
mergeFromin classcom.google.protobuf.AbstractMessage.Builder<Validation.Builder>
-
mergeFrom
-
isInitialized
public final boolean isInitialized()- Specified by:
isInitializedin interfacecom.google.protobuf.MessageLiteOrBuilder- Overrides:
isInitializedin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
mergeFrom
public Validation.Builder mergeFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException - Specified by:
mergeFromin interfacecom.google.protobuf.Message.Builder- Specified by:
mergeFromin interfacecom.google.protobuf.MessageLite.Builder- Overrides:
mergeFromin classcom.google.protobuf.AbstractMessage.Builder<Validation.Builder>- Throws:
IOException
-
getNodeIdFormat
Format string to extract the expected node identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-node-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports Envoy's :ref:`command operators <config_access_log_command_operators>`: * ``%DYNAMIC_METADATA(namespace:key)%``: Extract expected value from dynamic metadata. * ``%FILTER_STATE(key)%``: Extract expected value from filter state. * ``%DOWNSTREAM_REMOTE_ADDRESS%``: Use downstream connection IP address. * Plain strings: Use a static expected value. If empty, node ID validation is skipped. Example using dynamic metadata allowlist: .. code-block:: yaml node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%"string node_id_format = 1 [(.validate.rules) = { ... }- Specified by:
getNodeIdFormatin interfaceValidationOrBuilder- Returns:
- The nodeIdFormat.
-
getNodeIdFormatBytes
public com.google.protobuf.ByteString getNodeIdFormatBytes()Format string to extract the expected node identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-node-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports Envoy's :ref:`command operators <config_access_log_command_operators>`: * ``%DYNAMIC_METADATA(namespace:key)%``: Extract expected value from dynamic metadata. * ``%FILTER_STATE(key)%``: Extract expected value from filter state. * ``%DOWNSTREAM_REMOTE_ADDRESS%``: Use downstream connection IP address. * Plain strings: Use a static expected value. If empty, node ID validation is skipped. Example using dynamic metadata allowlist: .. code-block:: yaml node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%"string node_id_format = 1 [(.validate.rules) = { ... }- Specified by:
getNodeIdFormatBytesin interfaceValidationOrBuilder- Returns:
- The bytes for nodeIdFormat.
-
setNodeIdFormat
Format string to extract the expected node identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-node-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports Envoy's :ref:`command operators <config_access_log_command_operators>`: * ``%DYNAMIC_METADATA(namespace:key)%``: Extract expected value from dynamic metadata. * ``%FILTER_STATE(key)%``: Extract expected value from filter state. * ``%DOWNSTREAM_REMOTE_ADDRESS%``: Use downstream connection IP address. * Plain strings: Use a static expected value. If empty, node ID validation is skipped. Example using dynamic metadata allowlist: .. code-block:: yaml node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%"string node_id_format = 1 [(.validate.rules) = { ... }- Parameters:
value- The nodeIdFormat to set.- Returns:
- This builder for chaining.
-
clearNodeIdFormat
Format string to extract the expected node identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-node-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports Envoy's :ref:`command operators <config_access_log_command_operators>`: * ``%DYNAMIC_METADATA(namespace:key)%``: Extract expected value from dynamic metadata. * ``%FILTER_STATE(key)%``: Extract expected value from filter state. * ``%DOWNSTREAM_REMOTE_ADDRESS%``: Use downstream connection IP address. * Plain strings: Use a static expected value. If empty, node ID validation is skipped. Example using dynamic metadata allowlist: .. code-block:: yaml node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%"string node_id_format = 1 [(.validate.rules) = { ... }- Returns:
- This builder for chaining.
-
setNodeIdFormatBytes
Format string to extract the expected node identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-node-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports Envoy's :ref:`command operators <config_access_log_command_operators>`: * ``%DYNAMIC_METADATA(namespace:key)%``: Extract expected value from dynamic metadata. * ``%FILTER_STATE(key)%``: Extract expected value from filter state. * ``%DOWNSTREAM_REMOTE_ADDRESS%``: Use downstream connection IP address. * Plain strings: Use a static expected value. If empty, node ID validation is skipped. Example using dynamic metadata allowlist: .. code-block:: yaml node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%"string node_id_format = 1 [(.validate.rules) = { ... }- Parameters:
value- The bytes for nodeIdFormat to set.- Returns:
- This builder for chaining.
-
getClusterIdFormat
Format string to extract the expected cluster identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-cluster-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports the same :ref:`command operators <config_access_log_command_operators>` as ``node_id_format``. If empty, cluster ID validation is skipped. Example using filter state: .. code-block:: yaml cluster_id_format: "%FILTER_STATE(expected_cluster_id)%"string cluster_id_format = 2 [(.validate.rules) = { ... }- Specified by:
getClusterIdFormatin interfaceValidationOrBuilder- Returns:
- The clusterIdFormat.
-
getClusterIdFormatBytes
public com.google.protobuf.ByteString getClusterIdFormatBytes()Format string to extract the expected cluster identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-cluster-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports the same :ref:`command operators <config_access_log_command_operators>` as ``node_id_format``. If empty, cluster ID validation is skipped. Example using filter state: .. code-block:: yaml cluster_id_format: "%FILTER_STATE(expected_cluster_id)%"string cluster_id_format = 2 [(.validate.rules) = { ... }- Specified by:
getClusterIdFormatBytesin interfaceValidationOrBuilder- Returns:
- The bytes for clusterIdFormat.
-
setClusterIdFormat
Format string to extract the expected cluster identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-cluster-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports the same :ref:`command operators <config_access_log_command_operators>` as ``node_id_format``. If empty, cluster ID validation is skipped. Example using filter state: .. code-block:: yaml cluster_id_format: "%FILTER_STATE(expected_cluster_id)%"string cluster_id_format = 2 [(.validate.rules) = { ... }- Parameters:
value- The clusterIdFormat to set.- Returns:
- This builder for chaining.
-
clearClusterIdFormat
Format string to extract the expected cluster identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-cluster-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports the same :ref:`command operators <config_access_log_command_operators>` as ``node_id_format``. If empty, cluster ID validation is skipped. Example using filter state: .. code-block:: yaml cluster_id_format: "%FILTER_STATE(expected_cluster_id)%"string cluster_id_format = 2 [(.validate.rules) = { ... }- Returns:
- This builder for chaining.
-
setClusterIdFormatBytes
Format string to extract the expected cluster identifier for validation. The formatted value is compared against the ``x-envoy-reverse-tunnel-cluster-id`` header from the incoming handshake request. If they do not match, the connection is rejected with HTTP ``403 Forbidden``. Supports the same :ref:`command operators <config_access_log_command_operators>` as ``node_id_format``. If empty, cluster ID validation is skipped. Example using filter state: .. code-block:: yaml cluster_id_format: "%FILTER_STATE(expected_cluster_id)%"string cluster_id_format = 2 [(.validate.rules) = { ... }- Parameters:
value- The bytes for clusterIdFormat to set.- Returns:
- This builder for chaining.
-
getEmitDynamicMetadata
public boolean getEmitDynamicMetadata()Whether to emit validation results as dynamic metadata. When enabled, the filter emits metadata under the namespace specified by ``dynamic_metadata_namespace`` containing: * ``node_id``: The actual node ID from the handshake request. * ``cluster_id``: The actual cluster ID from the handshake request. * ``validation_result``: Either ``allowed`` or ``denied``. This metadata can be used by subsequent filters or for access logging. Defaults to ``false``.
bool emit_dynamic_metadata = 3;- Specified by:
getEmitDynamicMetadatain interfaceValidationOrBuilder- Returns:
- The emitDynamicMetadata.
-
setEmitDynamicMetadata
Whether to emit validation results as dynamic metadata. When enabled, the filter emits metadata under the namespace specified by ``dynamic_metadata_namespace`` containing: * ``node_id``: The actual node ID from the handshake request. * ``cluster_id``: The actual cluster ID from the handshake request. * ``validation_result``: Either ``allowed`` or ``denied``. This metadata can be used by subsequent filters or for access logging. Defaults to ``false``.
bool emit_dynamic_metadata = 3;- Parameters:
value- The emitDynamicMetadata to set.- Returns:
- This builder for chaining.
-
clearEmitDynamicMetadata
Whether to emit validation results as dynamic metadata. When enabled, the filter emits metadata under the namespace specified by ``dynamic_metadata_namespace`` containing: * ``node_id``: The actual node ID from the handshake request. * ``cluster_id``: The actual cluster ID from the handshake request. * ``validation_result``: Either ``allowed`` or ``denied``. This metadata can be used by subsequent filters or for access logging. Defaults to ``false``.
bool emit_dynamic_metadata = 3;- Returns:
- This builder for chaining.
-
getDynamicMetadataNamespace
Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``. If not specified, defaults to ``envoy.filters.network.reverse_tunnel``.
string dynamic_metadata_namespace = 4 [(.validate.rules) = { ... }- Specified by:
getDynamicMetadataNamespacein interfaceValidationOrBuilder- Returns:
- The dynamicMetadataNamespace.
-
getDynamicMetadataNamespaceBytes
public com.google.protobuf.ByteString getDynamicMetadataNamespaceBytes()Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``. If not specified, defaults to ``envoy.filters.network.reverse_tunnel``.
string dynamic_metadata_namespace = 4 [(.validate.rules) = { ... }- Specified by:
getDynamicMetadataNamespaceBytesin interfaceValidationOrBuilder- Returns:
- The bytes for dynamicMetadataNamespace.
-
setDynamicMetadataNamespace
Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``. If not specified, defaults to ``envoy.filters.network.reverse_tunnel``.
string dynamic_metadata_namespace = 4 [(.validate.rules) = { ... }- Parameters:
value- The dynamicMetadataNamespace to set.- Returns:
- This builder for chaining.
-
clearDynamicMetadataNamespace
Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``. If not specified, defaults to ``envoy.filters.network.reverse_tunnel``.
string dynamic_metadata_namespace = 4 [(.validate.rules) = { ... }- Returns:
- This builder for chaining.
-
setDynamicMetadataNamespaceBytes
Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``. If not specified, defaults to ``envoy.filters.network.reverse_tunnel``.
string dynamic_metadata_namespace = 4 [(.validate.rules) = { ... }- Parameters:
value- The bytes for dynamicMetadataNamespace to set.- Returns:
- This builder for chaining.
-
setUnknownFields
- Specified by:
setUnknownFieldsin interfacecom.google.protobuf.Message.Builder- Overrides:
setUnknownFieldsin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-
mergeUnknownFields
public final Validation.Builder mergeUnknownFields(com.google.protobuf.UnknownFieldSet unknownFields) - Specified by:
mergeUnknownFieldsin interfacecom.google.protobuf.Message.Builder- Overrides:
mergeUnknownFieldsin classcom.google.protobuf.GeneratedMessageV3.Builder<Validation.Builder>
-