// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.35.1
// source: envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto

package tlsv3

import (
	_ "github.com/cncf/xds/go/udpa/annotations"
	v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	_ "github.com/envoyproxy/protoc-gen-validate/validate"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// Configuration specific to the `SPIFFE <https://github.com/spiffe/spiffe>`_ certificate validator.
//
// Example:
//
// .. validated-code-block:: yaml
//
//	:type-name: envoy.extensions.transport_sockets.tls.v3.CertificateValidationContext
//
//	custom_validator_config:
//	  name: envoy.tls.cert_validator.spiffe
//	  typed_config:
//	    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig
//	    trust_domains:
//	    - name: foo.com
//	      trust_bundle:
//	        filename: "foo.pem"
//	    - name: envoy.com
//	      trust_bundle:
//	        filename: "envoy.pem"
//
// In this example, a presented peer certificate whose SAN matches “spiffe://foo.com/**“ is validated against
// the "foo.pem" x.509 certificate. All the trust bundles are isolated from each other, so no trust domain can mint
// a SVID belonging to another trust domain. That means, in this example, a SVID signed by “envoy.com“'s CA with “spiffe://foo.com/**“
// SAN would be rejected since Envoy selects the trust bundle according to the presented SAN before validate the certificate.
//
// Note that SPIFFE validator inherits and uses the following options from :ref:`CertificateValidationContext <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.CertificateValidationContext>`.
//
// - :ref:`allow_expired_certificate <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.allow_expired_certificate>` to allow expired certificates.
// - :ref:`match_typed_subject_alt_names <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CertificateValidationContext.match_typed_subject_alt_names>` to match **URI** SAN of certificates. Unlike the default validator, SPIFFE validator only matches **URI** SAN (which equals to SVID in SPIFFE terminology) and ignore other SAN types.
//
// To support multi-tenant use cases, a filter state object “envoy.tls.cert_validator.spiffe.workload_trust_domain“
// should be used to define the per-connection workload trust domain. When matching a peer trust domain, both the
// workload and the peer trust domains are used in selecting the validation certificate. The filter state object
// should be shared with the upstream to be used in the upstream TLS context SPIFFE validation context.
type SPIFFECertValidatorConfig struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// This field specifies trust domains used for validating incoming X.509-SVID(s).
	TrustDomains []*SPIFFECertValidatorConfig_TrustDomain `protobuf:"bytes,1,rep,name=trust_domains,json=trustDomains,proto3" json:"trust_domains,omitempty"`
	// This field specifies all trust bundles as a single DataSource. If both
	// trust_bundles and trust_domains are specified, trust_bundles will
	// take precedence. Currently assumes file will be a SPIFFE Trust Bundle Map.
	// If DataSource is a file, dynamic file watching will be enabled,
	// and updates to the specified file will trigger a refresh of the trust_bundles.
	TrustBundles  *v3.DataSource `protobuf:"bytes,2,opt,name=trust_bundles,json=trustBundles,proto3" json:"trust_bundles,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SPIFFECertValidatorConfig) Reset() {
	*x = SPIFFECertValidatorConfig{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SPIFFECertValidatorConfig) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SPIFFECertValidatorConfig) ProtoMessage() {}

func (x *SPIFFECertValidatorConfig) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SPIFFECertValidatorConfig.ProtoReflect.Descriptor instead.
func (*SPIFFECertValidatorConfig) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescGZIP(), []int{0}
}

func (x *SPIFFECertValidatorConfig) GetTrustDomains() []*SPIFFECertValidatorConfig_TrustDomain {
	if x != nil {
		return x.TrustDomains
	}
	return nil
}

func (x *SPIFFECertValidatorConfig) GetTrustBundles() *v3.DataSource {
	if x != nil {
		return x.TrustBundles
	}
	return nil
}

type SPIFFECertValidatorConfig_TrustDomain struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Name of the trust domain, “example.com“, “foo.bar.gov“ for example.
	// Note that this must *not* have "spiffe://" prefix.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Specify a data source holding x.509 trust bundle used for validating incoming SVID(s) in this trust domain.
	TrustBundle *v3.DataSource `protobuf:"bytes,2,opt,name=trust_bundle,json=trustBundle,proto3" json:"trust_bundle,omitempty"`
	// Optional workload trust domain selection condition. The filter object
	// “envoy.tls.cert_validator.spiffe.workload_trust_domain“ must match exactly the value of this field.
	// If not specified, the filter state object must be absent or be empty to match this trust domain.
	WorkloadTrustDomain string `protobuf:"bytes,3,opt,name=workload_trust_domain,json=workloadTrustDomain,proto3" json:"workload_trust_domain,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *SPIFFECertValidatorConfig_TrustDomain) Reset() {
	*x = SPIFFECertValidatorConfig_TrustDomain{}
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SPIFFECertValidatorConfig_TrustDomain) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SPIFFECertValidatorConfig_TrustDomain) ProtoMessage() {}

func (x *SPIFFECertValidatorConfig_TrustDomain) ProtoReflect() protoreflect.Message {
	mi := &file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SPIFFECertValidatorConfig_TrustDomain.ProtoReflect.Descriptor instead.
func (*SPIFFECertValidatorConfig_TrustDomain) Descriptor() ([]byte, []int) {
	return file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescGZIP(), []int{0, 0}
}

func (x *SPIFFECertValidatorConfig_TrustDomain) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *SPIFFECertValidatorConfig_TrustDomain) GetTrustBundle() *v3.DataSource {
	if x != nil {
		return x.TrustBundle
	}
	return nil
}

func (x *SPIFFECertValidatorConfig_TrustDomain) GetWorkloadTrustDomain() string {
	if x != nil {
		return x.WorkloadTrustDomain
	}
	return ""
}

var File_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto protoreflect.FileDescriptor

const file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDesc = "" +
	"\n" +
	"Kenvoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto\x12)envoy.extensions.transport_sockets.tls.v3\x1a\x1fenvoy/config/core/v3/base.proto\x1a\x1dudpa/annotations/status.proto\x1a\x17validate/validate.proto\"\x89\x03\n" +
	"\x19SPIFFECertValidatorConfig\x12\x7f\n" +
	"\rtrust_domains\x18\x01 \x03(\v2P.envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig.TrustDomainB\b\xfaB\x05\x92\x01\x02\b\x01R\ftrustDomains\x12E\n" +
	"\rtrust_bundles\x18\x02 \x01(\v2 .envoy.config.core.v3.DataSourceR\ftrustBundles\x1a\xa3\x01\n" +
	"\vTrustDomain\x12\x1b\n" +
	"\x04name\x18\x01 \x01(\tB\a\xfaB\x04r\x02\x10\x01R\x04name\x12C\n" +
	"\ftrust_bundle\x18\x02 \x01(\v2 .envoy.config.core.v3.DataSourceR\vtrustBundle\x122\n" +
	"\x15workload_trust_domain\x18\x03 \x01(\tR\x13workloadTrustDomainB\xba\x01\xba\x80\xc8\xd1\x06\x02\x10\x02\n" +
	"7io.envoyproxy.envoy.extensions.transport_sockets.tls.v3B\x1dTlsSpiffeValidatorConfigProtoP\x01ZVgithub.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3;tlsv3b\x06proto3"

var (
	file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescOnce sync.Once
	file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescData []byte
)

func file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescGZIP() []byte {
	file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescOnce.Do(func() {
		file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDesc), len(file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDesc)))
	})
	return file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDescData
}

var file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
var file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_goTypes = []any{
	(*SPIFFECertValidatorConfig)(nil),             // 0: envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig
	(*SPIFFECertValidatorConfig_TrustDomain)(nil), // 1: envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig.TrustDomain
	(*v3.DataSource)(nil),                         // 2: envoy.config.core.v3.DataSource
}
var file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_depIdxs = []int32{
	1, // 0: envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig.trust_domains:type_name -> envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig.TrustDomain
	2, // 1: envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig.trust_bundles:type_name -> envoy.config.core.v3.DataSource
	2, // 2: envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig.TrustDomain.trust_bundle:type_name -> envoy.config.core.v3.DataSource
	3, // [3:3] is the sub-list for method output_type
	3, // [3:3] is the sub-list for method input_type
	3, // [3:3] is the sub-list for extension type_name
	3, // [3:3] is the sub-list for extension extendee
	0, // [0:3] is the sub-list for field type_name
}

func init() { file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_init() }
func file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_init() {
	if File_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto != nil {
		return
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDesc), len(file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_rawDesc)),
			NumEnums:      0,
			NumMessages:   2,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_goTypes,
		DependencyIndexes: file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_depIdxs,
		MessageInfos:      file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_msgTypes,
	}.Build()
	File_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto = out.File
	file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_goTypes = nil
	file_envoy_extensions_transport_sockets_tls_v3_tls_spiffe_validator_config_proto_depIdxs = nil
}
