Create NFV Service.

POST

/api/config/namespaces/{metadata.namespace}/nfv_services

curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/config/namespaces/example/nfv_services \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "metadata": { "annotations": {}, "description": "example", "disable": true, "labels": {}, "name": "example", "namespace": "example" }, "spec": { "disable_https_management": {}, "disable_ssh_access": {}, "enabled_ssh_access": { "advertise_on_sli": {}, "advertise_on_slo": {}, "advertise_on_slo_sli": {}, "domain_suffix": "example", "node_ssh_ports": [ { "node_name": "example", "ssh_port": 1 } ] }, "f5_big_ip_aws_service": { "admin_password": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "admin_username": "example", "aws_tgw_site_params": { "aws_tgw_site": { "name": "example", "namespace": "example" } }, "endpoint_service": { "advertise_on_slo_ip": {}, "advertise_on_slo_ip_external": {}, "automatic_vip": {}, "configured_vip": "example", "custom_tcp_ports": { "ports": [ "example" ] }, "custom_udp_ports": { "ports": [ "example" ] }, "default_tcp_ports": {}, "disable_advertise_on_slo_ip": {}, "http_port": {}, "https_port": {}, "no_tcp_ports": {}, "no_udp_ports": {} }, "market_place_image": { "AWAFPayG200Mbps": {}, "AWAFPayG3Gbps": {} }, "nodes": [ { "automatic_prefix": {}, "aws_az_name": "example", "mgmt_subnet": { "existing_subnet_id": "example", "subnet_param": { "ipv4": "example" } }, "node_name": "example", "reserved_mgmt_subnet": {}, "tunnel_prefix": "example" } ], "ssh_key": "example", "tags": {} }, "https_management": { "advertise_on_internet": { "public_ip": { "name": "example", "namespace": "example" } }, "advertise_on_internet_default_vip": {}, "advertise_on_sli_vip": { "no_mtls": {}, "tls_certificates": [ { "certificate_url": "example", "custom_hash_algorithms": { "hash_algorithms": [ "INVALID_HASH_ALGORITHM" ] }, "description": "example", "disable_ocsp_stapling": {}, "private_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "use_system_defaults": {} } ], "tls_config": { "custom_security": { "cipher_suites": [ "example" ], "max_version": "TLS_AUTO", "min_version": "TLS_AUTO" }, "default_security": {}, "low_security": {}, "medium_security": {} }, "use_mtls": { "client_certificate_optional": true, "crl": { "name": "example", "namespace": "example" }, "no_crl": {}, "trusted_ca": { "name": "example", "namespace": "example" }, "trusted_ca_url": "example", "xfcc_disabled": {}, "xfcc_options": { "xfcc_header_elements": [ "XFCC_NONE" ] } } }, "advertise_on_slo_internet_vip": { "no_mtls": {}, "tls_certificates": [ { "certificate_url": "example", "custom_hash_algorithms": { "hash_algorithms": [ "INVALID_HASH_ALGORITHM" ] }, "description": "example", "disable_ocsp_stapling": {}, "private_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "use_system_defaults": {} } ], "tls_config": { "custom_security": { "cipher_suites": [ "example" ], "max_version": "TLS_AUTO", "min_version": "TLS_AUTO" }, "default_security": {}, "low_security": {}, "medium_security": {} }, "use_mtls": { "client_certificate_optional": true, "crl": { "name": "example", "namespace": "example" }, "no_crl": {}, "trusted_ca": { "name": "example", "namespace": "example" }, "trusted_ca_url": "example", "xfcc_disabled": {}, "xfcc_options": { "xfcc_header_elements": [ "XFCC_NONE" ] } } }, "advertise_on_slo_sli": { "no_mtls": {}, "tls_certificates": [ { "certificate_url": "example", "custom_hash_algorithms": { "hash_algorithms": [ "INVALID_HASH_ALGORITHM" ] }, "description": "example", "disable_ocsp_stapling": {}, "private_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "use_system_defaults": {} } ], "tls_config": { "custom_security": { "cipher_suites": [ "example" ], "max_version": "TLS_AUTO", "min_version": "TLS_AUTO" }, "default_security": {}, "low_security": {}, "medium_security": {} }, "use_mtls": { "client_certificate_optional": true, "crl": { "name": "example", "namespace": "example" }, "no_crl": {}, "trusted_ca": { "name": "example", "namespace": "example" }, "trusted_ca_url": "example", "xfcc_disabled": {}, "xfcc_options": { "xfcc_header_elements": [ "XFCC_NONE" ] } } }, "advertise_on_slo_vip": { "no_mtls": {}, "tls_certificates": [ { "certificate_url": "example", "custom_hash_algorithms": { "hash_algorithms": [ "INVALID_HASH_ALGORITHM" ] }, "description": "example", "disable_ocsp_stapling": {}, "private_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "use_system_defaults": {} } ], "tls_config": { "custom_security": { "cipher_suites": [ "example" ], "max_version": "TLS_AUTO", "min_version": "TLS_AUTO" }, "default_security": {}, "low_security": {}, "medium_security": {} }, "use_mtls": { "client_certificate_optional": true, "crl": { "name": "example", "namespace": "example" }, "no_crl": {}, "trusted_ca": { "name": "example", "namespace": "example" }, "trusted_ca_url": "example", "xfcc_disabled": {}, "xfcc_options": { "xfcc_header_elements": [ "XFCC_NONE" ] } } }, "default_https_port": {}, "domain_suffix": "example", "https_port": 1 }, "palo_alto_fw_service": { "auto_setup": { "admin_password": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "admin_username": "example", "manual_ssh_keys": { "private_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "public_key": "example" } }, "aws_tgw_site": { "name": "example", "namespace": "example" }, "disable_panaroma": {}, "instance_type": "PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_XLARGE", "pan_ami_bundle1": {}, "pan_ami_bundle2": {}, "panorama_server": { "authorization_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "device_group_name": "example", "server": "example", "template_stack_name": "example" }, "service_nodes": { "nodes": [ { "aws_az_name": "example", "mgmt_subnet": { "existing_subnet_id": "example", "subnet_param": { "ipv4": "example" } }, "node_name": "example", "reserved_mgmt_subnet": {} } ] }, "ssh_key": "example", "tags": {}, "version": "example" } } }'

• F5 Distributed Cloud Console

Creates a new NFV service with configured parameters.

Examples of this operation.

Authorizations

• ApiToken

Parameters

Path Parameters

metadata.namespace

required

string

Namespace This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

Request Body^required

Media typeapplication/json

CreateRequest is used to create an instance of nfv_service

This is the input message of the ‘Create’ RPC.

object

metadata

object

annotations

annotations

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.

object

description

description

Human readable description for the object.

string

>= 21 characters <= 1200 characters

disable

disable

A value of true will administratively disable the object.

boolean format: boolean

labels

labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the user. Values specified here will be used by selector expression.

object

name

name

This is the name of configuration object. It has to be unique within the namespace. It can only be specified during create API and cannot be changed during replace API. The value of name has to follow DNS-1035 format. Required: YES.

string

>= 6 characters <= 1024 characters

namespace

namespace

This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

string

>= 6 characters <= 1024 characters

spec

object

disable_https_management

object

disable_ssh_access

object

enabled_ssh_access

object

advertise_on_sli

object

advertise_on_slo

object

advertise_on_slo_sli

object

domain_suffix

Domain Suffix

Domain suffix will be used along with node name to form the hostname for SSH node management Required: YES.

string

<= 1024 characters

node_ssh_ports

List of SSH port and node name per node

Enter TCP port and node name per node

Required: YES.

Array<object>

<= 2 items

SSHManagement Port Configuration

TCP Port configuration per node.

object

node_name

Node Name

Node name will be used to match a particular node with the desired TCP port Required: YES.

string

>= 1 characters <= 256 characters

ssh_port

SSH port per node

Enter TCP port per node Required: YES.

integer format: int64

f5_big_ip_aws_service

object

admin_password

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

admin_username

Admin Username

Admin Username for BIG-IP Required: YES.

string

<= 256 characters

aws_tgw_site_params

object

aws_tgw_site

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

endpoint_service

object

advertise_on_slo_ip

object

advertise_on_slo_ip_external

object

automatic_vip

object

configured_vip

Configured

Exclusive with [automatic_vip] Enter IP address for the default VIP.

string

<= 1024 characters

custom_tcp_ports

object

ports

ports

List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192 Required: YES.

Array<string>

<= 128 items

custom_udp_ports

object

ports

ports

List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192 Required: YES.

Array<string>

<= 128 items

default_tcp_ports

object

disable_advertise_on_slo_ip

object

http_port

object

https_port

object

no_tcp_ports

object

no_udp_ports

object

market_place_image

object

AWAFPayG200Mbps

object

AWAFPayG3Gbps

object

nodes

Service Nodes

Specify how and where the service nodes are spawned

Required: YES.

Array<object>

>= 1 items <= 2 items

Service Nodes

Specification for service nodes, how and where.

object

automatic_prefix

object

aws_az_name

AWS AZ

The AWS Availability Zone must be consistent with the AWS Region chosen. Please select an AZ in the same Region as your TGW Site Required: YES.

string

<= 1024 characters

mgmt_subnet

object

existing_subnet_id

Existing Subnet ID

Exclusive with [subnet_param] Information about existing subnet ID.

string

<= 64 characters

subnet_param

object

ipv4

IPv4 Subnet

IPv4 subnet prefix for this subnet Required: YES.

string format: ipv4

<= 1024 characters

node_name

Node Name

Node Name will be used to assign as hostname to the service Required: YES.

string

>= 1 characters <= 256 characters

reserved_mgmt_subnet

object

tunnel_prefix

Tunnel IP Prefix

Exclusive with [automatic_prefix] Enter IP prefix for the tunnel, it has to be /30.

string

<= 1024 characters

ssh_key

Public SSH key

Public SSH key for accessing the Big IP nodes. Required: YES.

string

>= 1 characters <= 8192 characters

tags

AWS Tags

AWS Tags is a label consisting of a user-defined key and value. It helps to manage, identify, organize, search for, and filter resources in AWS console.

object

https_management

object

advertise_on_internet

object

public_ip

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

advertise_on_internet_default_vip

object

advertise_on_sli_vip

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

advertise_on_slo_internet_vip

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

advertise_on_slo_sli

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

advertise_on_slo_vip

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

default_https_port

object

domain_suffix

Domain Suffix

Domain suffix will be used along with node name to form URL to access node management Required: YES.

string

<= 1024 characters

https_port

HTTPS port

Exclusive with [default_https_port] Enter TCP port number.

integer format: int64

palo_alto_fw_service

object

auto_setup

object

admin_password

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

admin_username

Firewall Admin Username

Firewall Admin Username Required: YES.

string

<= 256 characters

manual_ssh_keys

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

public_key

Public SSH key

Authorized Public SSH key which will be programmed on the node Required: YES.

string

>= 1 characters <= 8192 characters

aws_tgw_site

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

disable_panaroma

object

instance_type

string

default: PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_XLARGE

Allowed values: PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_12XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_8XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_9XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_18XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_9XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_18XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_R5_2XLARGE

pan_ami_bundle1

object

pan_ami_bundle2

object

panorama_server

object

authorization_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

device_group_name

Device Group Name

Device Group Name.

string

<= 128 characters

server

Server Ipv4 Address

Panorama Server Address to which the firewall should connect to Required: YES.

string

<= 1024 characters

template_stack_name

Template Stack Name

Template Stack Name.

string

<= 128 characters

service_nodes

object

nodes

Palo Alto Networks AZ Nodes

Required: YES.

Array<object>

>= 1 items <= 2 items

Service Nodes

Specification for service nodes, how and where.

object

aws_az_name

AWS AZ

AWS availability zone, must be consistent with the selected AWS region. It is recommended that AZ is one of the AZ for sites Required: YES.

string

<= 1024 characters

mgmt_subnet

object

existing_subnet_id

Existing Subnet ID

Exclusive with [subnet_param] Information about existing subnet ID.

string

<= 64 characters

subnet_param

object

ipv4

IPv4 Subnet

IPv4 subnet prefix for this subnet Required: YES.

string format: ipv4

<= 1024 characters

node_name

Node Name

Node Name will be used to assign as hostname to the service Required: YES.

string

>= 1 characters <= 256 characters

reserved_mgmt_subnet

object

ssh_key

Setup Authorized Public SSH key

Exclusive with [auto_setup] Setup Authorized Public SSH key. User will be able to SSH to the vmseries nodes using its corresponding SSH private key.

string

>= 1 characters <= 8192 characters

tags

AWS Tags

AWS Tags is a label consisting of a user-defined key and value. It helps to manage, identify, organize, search for, and filter resources in AWS console.

object

version

PAN VM-Series version

PAN-OS version.

string

>= 1 characters <= 1024 characters

Responses

200

A successful response.

Media typeapplication/json

object

metadata

object

annotations

annotations

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.

object

description

description

Human readable description for the object.

string

>= 21 characters <= 1200 characters

disable

disable

A value of true will administratively disable the object.

boolean format: boolean

labels

labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the user. Values specified here will be used by selector expression.

object

name

name

This is the name of configuration object. It has to be unique within the namespace. It can only be specified during create API and cannot be changed during replace API. The value of name has to follow DNS-1035 format. Required: YES.

string

>= 6 characters <= 1024 characters

namespace

namespace

This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

string

>= 6 characters <= 1024 characters

spec

object

disable_https_management

object

disable_ssh_access

object

enabled_ssh_access

object

advertise_on_sli

object

advertise_on_slo

object

advertise_on_slo_sli

object

domain_suffix

Domain Suffix

Domain suffix will be used along with node name to form the hostname for SSH node management Required: YES.

string

<= 1024 characters

node_ssh_ports

List of SSH port and node name per node

Enter TCP port and node name per node

Required: YES.

Array<object>

<= 2 items

SSHManagement Port Configuration

TCP Port configuration per node.

object

node_name

Node Name

Node name will be used to match a particular node with the desired TCP port Required: YES.

string

>= 1 characters <= 256 characters

ssh_port

SSH port per node

Enter TCP port per node Required: YES.

integer format: int64

endpoint_service

object

advertise_on_slo_ip

object

advertise_on_slo_ip_external

object

automatic_vip

object

configured_vip

Configured

Exclusive with [automatic_vip] Enter IP address for the default VIP.

string

<= 1024 characters

custom_tcp_ports

object

ports

ports

List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192 Required: YES.

Array<string>

<= 128 items

custom_udp_ports

object

ports

ports

List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192 Required: YES.

Array<string>

<= 128 items

default_tcp_ports

object

disable_advertise_on_slo_ip

object

http_port

object

https_port

object

no_tcp_ports

object

no_udp_ports

object

f5_big_ip_aws_service

object

admin_password

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

admin_username

Admin Username

Admin Username for BIG-IP Required: YES.

string

<= 256 characters

aws_tgw_site_params

object

aws_tgw_site

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

endpoint_service

object

advertise_on_slo_ip

object

advertise_on_slo_ip_external

object

automatic_vip

object

configured_vip

Configured

Exclusive with [automatic_vip] Enter IP address for the default VIP.

string

<= 1024 characters

custom_tcp_ports

object

ports

ports

List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192 Required: YES.

Array<string>

<= 128 items

custom_udp_ports

object

ports

ports

List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192 Required: YES.

Array<string>

<= 128 items

default_tcp_ports

object

disable_advertise_on_slo_ip

object

http_port

object

https_port

object

no_tcp_ports

object

no_udp_ports

object

market_place_image

object

AWAFPayG200Mbps

object

AWAFPayG3Gbps

object

nodes

Service Nodes

Specify how and where the service nodes are spawned

Required: YES.

Array<object>

>= 1 items <= 2 items

Service Nodes

Specification for service nodes, how and where.

object

automatic_prefix

object

aws_az_name

AWS AZ

The AWS Availability Zone must be consistent with the AWS Region chosen. Please select an AZ in the same Region as your TGW Site Required: YES.

string

<= 1024 characters

mgmt_subnet

object

existing_subnet_id

Existing Subnet ID

Exclusive with [subnet_param] Information about existing subnet ID.

string

<= 64 characters

subnet_param

object

ipv4

IPv4 Subnet

IPv4 subnet prefix for this subnet Required: YES.

string format: ipv4

<= 1024 characters

node_name

Node Name

Node Name will be used to assign as hostname to the service Required: YES.

string

>= 1 characters <= 256 characters

reserved_mgmt_subnet

object

tunnel_prefix

Tunnel IP Prefix

Exclusive with [automatic_prefix] Enter IP prefix for the tunnel, it has to be /30.

string

<= 1024 characters

ssh_key

Public SSH key

Public SSH key for accessing the Big IP nodes. Required: YES.

string

>= 1 characters <= 8192 characters

tags

AWS Tags

AWS Tags is a label consisting of a user-defined key and value. It helps to manage, identify, organize, search for, and filter resources in AWS console.

object

forwarding_service

object

https_management

object

advertise_on_internet

object

public_ip

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

advertise_on_internet_default_vip

object

advertise_on_sli_vip

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

advertise_on_slo_internet_vip

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

advertise_on_slo_sli

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

advertise_on_slo_vip

object

no_mtls

object

tls_certificates

tls_certificates

Users can add one or more certificates that share the same set of domains. For example, domain.com and *.domain.com - but use different signature algorithms

Required: YES.

Array<object>

>= 1 items <= 16 items

TlsCertificateType

Handle to fetch certificate and key.

object

certificate_url

certificate_url

TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.

string

>= 1 characters <= 131072 characters

custom_hash_algorithms

object

hash_algorithms

Hash Algorithms

Ordered list of hash algorithms to be used.

Required: YES.

Array<string>

>= 1 items <= 4 items

Allowed values: INVALID_HASH_ALGORITHM SHA256 SHA1

description

description

Description for the certificate.

string

>= 21 characters <= 1024 characters

disable_ocsp_stapling

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

use_system_defaults

object

tls_config

object

custom_security

object

cipher_suites

cipher_suites

The TLS listener will only support the specified cipher list. Required: YES.

Array<string>

max_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

min_version

string

default: TLS_AUTO

Allowed values: TLS_AUTO TLSv1_0 TLSv1_1 TLSv1_2 TLSv1_3

default_security

object

low_security

object

medium_security

object

use_mtls

object

client_certificate_optional

client_certificate_optional

Client certificate is optional. If the client has provided a certificate, the load balancer will verify it. If certification verification fails, the connection will be terminated. If the client does not provide a certificate, the connection will be accepted.

boolean format: boolean

crl

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

no_crl

object

trusted_ca

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

trusted_ca_url

trusted_ca_url

Exclusive with [trusted_ca] Upload a Root CA Certificate specifically for this Load Balancer.

string

>= 1 characters <= 131072 characters

xfcc_disabled

object

xfcc_options

object

xfcc_header_elements

XFCC Header

X-Forwarded-Client-Cert header elements to be added to requests

Required: YES.

Array<string>

Allowed values: XFCC_NONE XFCC_CERT XFCC_CHAIN XFCC_SUBJECT XFCC_URI XFCC_DNS

default_https_port

object

domain_suffix

Domain Suffix

Domain suffix will be used along with node name to form URL to access node management Required: YES.

string

<= 1024 characters

https_port

HTTPS port

Exclusive with [default_https_port] Enter TCP port number.

integer format: int64

node_info

Node level information like, SSH command ex strings are populated here.

Array<object>

Per Node Information

Per Node Information, populated after NFV instances are deployed.

object

node_name

Node Name

The name of the Node which corresponds to the SSH command.

string

<= 1024 characters

ssh_command

SSH Command

Example SSH command string for users to SSH into individual node.

string

<= 1024 characters

palo_alto_fw_service

object

auto_setup

object

admin_password

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

admin_username

Firewall Admin Username

Firewall Admin Username Required: YES.

string

<= 256 characters

manual_ssh_keys

object

private_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

public_key

Public SSH key

Authorized Public SSH key which will be programmed on the node Required: YES.

string

>= 1 characters <= 8192 characters

aws_tgw_site

object

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string

>= 1 characters <= 128 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 64 characters

tenant

tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string

>= 6 characters <= 64 characters

disable_panaroma

object

instance_type

string

default: PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_XLARGE

Allowed values: PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5_12XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_M5N_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C4_8XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_9XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5_18XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_LARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_2XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_4XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_9XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_C5N_18XLARGE PALO_ALTO_FW_AWS_INSTANCE_TYPE_R5_2XLARGE

pan_ami_bundle1

object

pan_ami_bundle2

object

panorama_server

object

authorization_key

object

blindfold_secret_info

object

decryption_provider

Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string

<= 1024 characters

location

Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string

>= 4 characters <= 1024 characters

store_provider

Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

<= 1024 characters

clear_secret_info

object

provider

Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string

>= 3 characters <= 1024 characters

url

URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri

<= 131072 characters

device_group_name

Device Group Name

Device Group Name.

string

<= 128 characters

server

Server Ipv4 Address

Panorama Server Address to which the firewall should connect to Required: YES.

string

<= 1024 characters

template_stack_name

Template Stack Name

Template Stack Name.

string

<= 128 characters

service_nodes

object

nodes

Palo Alto Networks AZ Nodes

Required: YES.

Array<object>

>= 1 items <= 2 items

Service Nodes

Specification for service nodes, how and where.

object

aws_az_name

AWS AZ

AWS availability zone, must be consistent with the selected AWS region. It is recommended that AZ is one of the AZ for sites Required: YES.

string

<= 1024 characters

mgmt_subnet

object

existing_subnet_id

Existing Subnet ID

Exclusive with [subnet_param] Information about existing subnet ID.

string

<= 64 characters

subnet_param

object

ipv4

IPv4 Subnet

IPv4 subnet prefix for this subnet Required: YES.

string format: ipv4

<= 1024 characters

node_name

Node Name

Node Name will be used to assign as hostname to the service Required: YES.

string

>= 1 characters <= 256 characters

reserved_mgmt_subnet

object

ssh_key

Setup Authorized Public SSH key

Exclusive with [auto_setup] Setup Authorized Public SSH key. User will be able to SSH to the vmseries nodes using its corresponding SSH private key.

string

>= 1 characters <= 8192 characters

tags

AWS Tags

AWS Tags is a label consisting of a user-defined key and value. It helps to manage, identify, organize, search for, and filter resources in AWS console.

object

version

PAN VM-Series version

PAN-OS version.

string

>= 1 characters <= 1024 characters

transparent_service

object

system_metadata

object

creation_timestamp

creation_timestamp

CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

string format: date-time

<= 1024 characters

creator_class

creator_class

A value identifying the class of the user or service which created this configuration object.

string

<= 1024 characters

creator_id

creator_id

A value identifying the exact user or service that created this configuration object.

string

<= 1024 characters

deletion_timestamp

deletion_timestamp

DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

Populated by the system when a graceful deletion is requested. Read-only.

string format: date-time

<= 1024 characters

finalizers

finalizers

Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.

Array<string>

initializers

object

pending

pending

Pending is a list of initializers that must execute in order before this object is initialized. When the last pending initializer is removed, and no failing result is set, the initializers struct will be set to nil and the object is considered as initialized and visible to all clients.

Array<object>

InitializerType

Initializer is information about an initializer that has not yet completed.

object

name

name

Name of the service that is responsible for initializing this object.

string

>= 6 characters <= 1024 characters

result

object

code

code

Suggested HTTP return code for this status, 0 if not set.

integer format: int32

reason

reason

A human-readable description of why this operation is in the “Failure” status. If this value is empty there is no information available.

string

>= 27 characters <= 1024 characters

status

status

Status of the operation. One of: “Success” or “Failure”.

string

>= 17 characters <= 1024 characters

labels

labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the operator or software. Values here can be interpreted by software(backend or frontend) to enable certain behavior e.g. Things marked as soft-deleted(restorable).

object

modification_timestamp

modification_timestamp

ModificationTimestamp is a timestamp representing the server time when this object was last modified.

string format: date-time

<= 1024 characters

object_index

object_index

Unique index for the object. Some objects need a unique integer index to be allocated for each object type. This field will be populated for all objects that need it and will be zero otherwise.

integer format: int64

owner_view

object

kind

kind

Kind of the view object.

string

>= 12 characters <= 1024 characters

name

name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string

>= 6 characters <= 1024 characters

namespace

namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string

>= 6 characters <= 1024 characters

uid

uid

UID of the view object.

string format: uuid

>= 36 characters <= 1024 characters

tenant

tenant

Tenant to which this configuration object belongs to. The value for this is found from presented credentials.

string

>= 6 characters <= 1024 characters

uid

uid

Uid is the unique in time and space value for this object. It is generated by the server on successful creation of an object and is not allowed to change on Replace API. The value of is taken from uid field of ObjectMetaType, if provided.

string format: uuid

>= 36 characters <= 1024 characters

Example

{
  "spec": {
    "https_management": {
      "advertise_on_sli_vip": {
        "tls_certificates": [
          {
            "custom_hash_algorithms": {
              "hash_algorithms": [
                "INVALID_HASH_ALGORITHM"
              ]
            }
          }
        ],
        "tls_config": {
          "custom_security": {
            "max_version": "TLS_AUTO",
            "min_version": "TLS_AUTO"
          }
        },
        "use_mtls": {
          "xfcc_options": {
            "xfcc_header_elements": [
              "XFCC_NONE"
            ]
          }
        }
      },
      "advertise_on_slo_internet_vip": {
        "tls_certificates": [
          {
            "custom_hash_algorithms": {
              "hash_algorithms": [
                "INVALID_HASH_ALGORITHM"
              ]
            }
          }
        ],
        "tls_config": {
          "custom_security": {
            "max_version": "TLS_AUTO",
            "min_version": "TLS_AUTO"
          }
        },
        "use_mtls": {
          "xfcc_options": {
            "xfcc_header_elements": [
              "XFCC_NONE"
            ]
          }
        }
      },
      "advertise_on_slo_sli": {
        "tls_certificates": [
          {
            "custom_hash_algorithms": {
              "hash_algorithms": [
                "INVALID_HASH_ALGORITHM"
              ]
            }
          }
        ],
        "tls_config": {
          "custom_security": {
            "max_version": "TLS_AUTO",
            "min_version": "TLS_AUTO"
          }
        },
        "use_mtls": {
          "xfcc_options": {
            "xfcc_header_elements": [
              "XFCC_NONE"
            ]
          }
        }
      },
      "advertise_on_slo_vip": {
        "tls_certificates": [
          {
            "custom_hash_algorithms": {
              "hash_algorithms": [
                "INVALID_HASH_ALGORITHM"
              ]
            }
          }
        ],
        "tls_config": {
          "custom_security": {
            "max_version": "TLS_AUTO",
            "min_version": "TLS_AUTO"
          }
        },
        "use_mtls": {
          "xfcc_options": {
            "xfcc_header_elements": [
              "XFCC_NONE"
            ]
          }
        }
      }
    },
    "palo_alto_fw_service": {
      "instance_type": "PALO_ALTO_FW_AWS_INSTANCE_TYPE_M4_XLARGE"
    }
  }
}

401

Returned when operation is not authorized.

Media typeapplication/json

string format: string

Example^generated

example

403

Returned when there is no permission to access resource.

Media typeapplication/json

string format: string

Example^generated

example

404

Returned when resource is not found.

Media typeapplication/json

string format: string

Example^generated

example

409

Returned when operation on resource is conflicting with current value.

Media typeapplication/json

string format: string

Example^generated

example

429

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json

string format: string

Example^generated

example

500

Returned when server encountered an error in processing API.

Media typeapplication/json

string format: string

Example^generated

example

503

Returned when service is unavailable temporarily.

Media typeapplication/json

string format: string

Example^generated

example

504

Returned when server timed out processing request.

Media typeapplication/json

string format: string

Example^generated

example