Replace Cluster.
const url = 'https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/config/namespaces/example/clusters/example';const options = { method: 'PUT', headers: {Authorization: '<Authorization>', 'Content-Type': 'application/json'}, body: '{"metadata":{"annotations":{},"description":"example","disable":true,"labels":{},"name":"example","namespace":"example"},"spec":{"auto_http_config":{},"circuit_breaker":{"connection_limit":1,"max_requests":1,"pending_requests":1,"priority":"DEFAULT","retries":1},"connection_timeout":1,"default_subset":{},"disable_proxy_protocol":{},"endpoint_selection":"DISTRIBUTED","endpoint_subsets":[{"keys":["example"]}],"endpoints":[{"name":"example","namespace":"example"}],"fallback_policy":"NO_FALLBACK","health_checks":[{"name":"example","namespace":"example"}],"http1_config":{"header_transformation":{"default_header_transformation":{},"legacy_header_transformation":{},"preserve_case_header_transformation":{},"proper_case_header_transformation":{}}},"http2_options":{"enabled":true},"http_idle_timeout":1,"loadbalancer_algorithm":"ROUND_ROBIN","no_panic_threshold":{},"outlier_detection":{"base_ejection_time":1,"consecutive_5xx":1,"consecutive_gateway_failure":1,"interval":1,"max_ejection_percent":1},"panic_threshold":1,"proxy_protocol_v1":{},"proxy_protocol_v2":{},"tls_parameters":{"cert_params":{"certificates":[{"name":"example","namespace":"example"}],"cipher_suites":["example"],"maximum_protocol_version":"TLS_AUTO","minimum_protocol_version":"TLS_AUTO","validation_params":{"skip_hostname_verification":true,"trusted_ca":{"trusted_ca_list":[{"name":"example","namespace":"example"}]},"trusted_ca_url":"example","verify_subject_alt_names":["example"]}},"common_params":{"cipher_suites":["example"],"maximum_protocol_version":"TLS_AUTO","minimum_protocol_version":"TLS_AUTO","tls_certificates":[{"certificate_url":"example","custom_hash_algorithms":{"hash_algorithms":["INVALID_HASH_ALGORITHM"]},"description":"example","disable_ocsp_stapling":{},"private_key":{"blindfold_secret_info":{"decryption_provider":"example","location":"example","store_provider":"example"},"clear_secret_info":{"provider":"example","url":"https://example.com"}},"use_system_defaults":{}}],"validation_params":{"skip_hostname_verification":true,"trusted_ca":{"trusted_ca_list":[{"name":"example","namespace":"example"}]},"trusted_ca_url":"example","verify_subject_alt_names":["example"]}},"default_session_key_caching":{},"disable_session_key_caching":{},"disable_sni":{},"max_session_keys":1,"sni":"example","use_host_header_as_sni":{}},"upstream_conn_pool_reuse_type":{"disable_conn_pool_reuse":{},"enable_conn_pool_reuse":{}},"max_requests_per_connection":1,"no_request_limit_per_connection":{}}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PUT \ --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/config/namespaces/example/clusters/example \ --header 'Authorization: <Authorization>' \ --header 'Content-Type: application/json' \ --data '{ "metadata": { "annotations": {}, "description": "example", "disable": true, "labels": {}, "name": "example", "namespace": "example" }, "spec": { "auto_http_config": {}, "circuit_breaker": { "connection_limit": 1, "max_requests": 1, "pending_requests": 1, "priority": "DEFAULT", "retries": 1 }, "connection_timeout": 1, "default_subset": {}, "disable_proxy_protocol": {}, "endpoint_selection": "DISTRIBUTED", "endpoint_subsets": [ { "keys": [ "example" ] } ], "endpoints": [ { "name": "example", "namespace": "example" } ], "fallback_policy": "NO_FALLBACK", "health_checks": [ { "name": "example", "namespace": "example" } ], "http1_config": { "header_transformation": { "default_header_transformation": {}, "legacy_header_transformation": {}, "preserve_case_header_transformation": {}, "proper_case_header_transformation": {} } }, "http2_options": { "enabled": true }, "http_idle_timeout": 1, "loadbalancer_algorithm": "ROUND_ROBIN", "no_panic_threshold": {}, "outlier_detection": { "base_ejection_time": 1, "consecutive_5xx": 1, "consecutive_gateway_failure": 1, "interval": 1, "max_ejection_percent": 1 }, "panic_threshold": 1, "proxy_protocol_v1": {}, "proxy_protocol_v2": {}, "tls_parameters": { "cert_params": { "certificates": [ { "name": "example", "namespace": "example" } ], "cipher_suites": [ "example" ], "maximum_protocol_version": "TLS_AUTO", "minimum_protocol_version": "TLS_AUTO", "validation_params": { "skip_hostname_verification": true, "trusted_ca": { "trusted_ca_list": [ { "name": "example", "namespace": "example" } ] }, "trusted_ca_url": "example", "verify_subject_alt_names": [ "example" ] } }, "common_params": { "cipher_suites": [ "example" ], "maximum_protocol_version": "TLS_AUTO", "minimum_protocol_version": "TLS_AUTO", "tls_certificates": [ { "certificate_url": "example", "custom_hash_algorithms": { "hash_algorithms": [ "INVALID_HASH_ALGORITHM" ] }, "description": "example", "disable_ocsp_stapling": {}, "private_key": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "use_system_defaults": {} } ], "validation_params": { "skip_hostname_verification": true, "trusted_ca": { "trusted_ca_list": [ { "name": "example", "namespace": "example" } ] }, "trusted_ca_url": "example", "verify_subject_alt_names": [ "example" ] } }, "default_session_key_caching": {}, "disable_session_key_caching": {}, "disable_sni": {}, "max_session_keys": 1, "sni": "example", "use_host_header_as_sni": {} }, "upstream_conn_pool_reuse_type": { "disable_conn_pool_reuse": {}, "enable_conn_pool_reuse": {} }, "max_requests_per_connection": 1, "no_request_limit_per_connection": {} } }'Replacing an cluster object will update the object by replacing the existing spec with the provided one. For read-then-write operations a resourceVersion mismatch will occur if the object was modified between the read and write.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Namespace This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""
Name The configuration object to be replaced will be looked up by name.
Request Bodyrequired
Section titled “Request Bodyrequired”This is the input message of the ‘Replace’ RPC.
object
object
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.
object
Human readable description for the object.
A value of true will administratively disable the object.
Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the user. Values specified here will be used by selector expression.
object
This is the name of configuration object. It has to be unique within the namespace. It can only be specified during create API and cannot be changed during replace API. The value of name has to follow DNS-1035 format. Required: YES.
This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""
object
object
object
The maximum number of connections that loadbalancer will establish to all hosts in an upstream cluster. In practice this is only applicable to TCP and HTTP/1.1 clusters since HTTP/2 uses a single connection to each host. Remove endpoint out of load balancing decision, if number of connections reach connection limit.
The maximum number of requests that can be outstanding to all hosts in a cluster at any given time. In practice this is applicable to HTTP/2 clusters since HTTP/1.1 clusters are governed by the maximum connections (connection_limit). Remove endpoint out of load balancing decision, if requests exceed this count.
The maximum number of requests that will be queued while waiting for a ready connection pool connection. Since HTTP/2 requests are sent over a single connection, this circuit breaker only comes into play as the initial connection is created, as requests will be multiplexed immediately afterwards. For HTTP/1.1, requests are added to the list of pending requests whenever there aren’t enough upstream connections available to immediately dispatch the request, so this circuit breaker will remain in play for the lifetime of the process. Remove endpoint out of load balancing decision, if pending request reach pending_request.
The maximum number of retries that can be outstanding to all hosts in a cluster at any given time. Remove endpoint out of load balancing decision, if retries for request exceed this count.
The timeout for new network connections to endpoints in the cluster. This is specified in milliseconds. The default value is 2 seconds.
List of key-value pairs that define default subset. This subset can be referred in fallback_policy which gets used when route specifies no metadata or no subset matching the metadata exists.
object
object
Cluster may be configured to divide its endpoints into subsets based on metadata attached to the endpoints. Routes may then specify the metadata that a endpoint must match in order to be selected by the load balancer.
Endpoint_subsets is list of subsets for this cluster. Each entry in this list has definition for a subset (which is collection of keys)
During routing, the route’s metadata match configuration is used to find a specific subset. If there is a subset with the exact keys and values specified by the route, the subset is used for load balancing. Otherwise, the fallback policy is used. The cluster’s subset configuration must, therefore, contain a definition that has the same keys as a given route in order for subset load balancing to occur.
Example:
RouteConfig
routes:
- match:
- headers: [] path: path: /1.log query_params: [] routeDestination: destinations:
- cluster:
- kind: cluster.object uid: 00000000-0000-0000-0001-000000000005 endpointSubsets: site: india
EndpointConfig
metadata: labels: deployment: debug site: india name: end-1 uid: end-1
ClusterConfig
gcSpec: defaultSubset: stage: production fallbackPolicy: DEFAULT_SUBSET endpointSubsets:
- keys:
- site
- keys:
- stage
- app
Assume the below endpoints are defined and associated with the cluster.
Endpoint Labels
ep1 stage: production, site: india ep2 stage: deployment, site: us ep3 stage: production, app: hr ep4 site: india
The following table describes some routes and the result of their application to the cluster. The subset definition for cluster is assumed to be same as given above in the ClusterConfig section
RouteMatch Criteria Subset Reason
site: india ep1, ep4 Subset of endpoints selected site: us ep2 Subset of endpoints selected app: hr ep1, ep3 Fallback: No subset selector for “app” alone stage: production, app: hr ep3 Subset of endpoints selected other: x ep1, ep3 Fallback: No subset selector for “other” (none) ep1, ep3 Fallback: No subset requested.
Upstream cluster may be configured to divide its endpoints into subsets based on metadata attached to the endpoints. Routes may then specify the metadata that a endpoint must match in order to be selected by the load balancer. List of keys that define a cluster subset. Each endpoint that has a metadata value for all of the keys in the definition is added to that subset. If no endpoint has all the keys, no subsets result from the definition. A single endpoint may appear in multiple subsets if it matches multiple definitions.
object
List of keys that define a cluster subset class. Required: YES.
List of references to all endpoint objects that belong to this cluster.
This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)
object
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.
List of references to healthcheck object for this cluster.
This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)
object
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.
object
object
object
object
object
object
object
Enable/disable HTTP2 Protocol for upstream connections.
The idle timeout for upstream connection pool connections. The idle timeout is defined as the period in which there are no active requests. When the idle timeout is reached the connection will be closed. Note that request based timeouts mean that HTTP/2 PINGs will not keep the connection alive. This is specified in milliseconds. The default value is 5 minutes.
object
object
The base time that a host is ejected for. The real time is equal to the base time multiplied by the number of times the host has been ejected. This causes hosts to GET ejected for longer periods if they continue to fail. Defaults to 30000ms or 30s. Specified in milliseconds.
If an upstream endpoint returns some number of consecutive 5xx, it will be ejected. Note that in this case a 5xx means an actual 5xx respond code, or an event that would cause the HTTP router to return one on the upstream’s behalf(reset, connection failure, etc.) consecutive_5xx indicates the number of consecutive 5xx responses required before a consecutive 5xx ejection occurs. Defaults to 5.
If an upstream endpoint returns some number of consecutive “gateway errors” (502, 503 or 504 status code), it will be ejected. Note that this includes events that would cause the HTTP router to return one of these status codes on the upstream’s behalf (reset, connection failure, etc.). Consecutive_gateway_failure indicates the number of consecutive gateway failures before a consecutive gateway failure ejection occurs. Defaults to 5.
The time interval between ejection analysis sweeps. This can result in both new ejections as well as endpoints being returned to service. Defaults to 10000ms or 10s. Specified in milliseconds.
The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% but will eject at least one host regardless of the value.
Exclusive with [no_panic_threshold]
Configure a threshold (percentage of unhealthy endpoints) below which all endpoints will be considered for loadbalancing ignoring its health status.
object
object
object
object
Client TLS Certificate required for mTLS authentication
Required: YES.
This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)
object
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.
The following list specifies the supported cipher suite TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384
If not specified, the default list: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 will be used.
object
When True, skip verification of hostname i.e. CN/Subject Alt Name of certificate is not matched to the connecting hostname.
object
Reference to Root CA Certificate.
This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)
object
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.
Exclusive with [trusted_ca] Inline Root CA Certificate.
List of acceptable Subject Alt Names/CN in the peer’s certificate. When skip_hostname_verification is false and verify_subject_alt_names is empty, the hostname of the peer will be used for matching against SAN/CN of peer’s certificate.
object
The following list specifies the supported cipher suite TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384
If not specified, the default list: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 will be used.
Set of TLS certificates.
Handle to fetch certificate and key.
object
TLS certificate. Certificate or certificate chain in PEM format including the PEM headers. Required: YES.
object
Ordered list of hash algorithms to be used.
Required: YES.
Description for the certificate.
object
object
object
Name of the Secret Management Access object that contains information about the backend Secret Management service.
Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.
object
Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.
URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.
object
object
When True, skip verification of hostname i.e. CN/Subject Alt Name of certificate is not matched to the connecting hostname.
object
Reference to Root CA Certificate.
This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)
object
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.
Exclusive with [trusted_ca] Inline Root CA Certificate.
List of acceptable Subject Alt Names/CN in the peer’s certificate. When skip_hostname_verification is false and verify_subject_alt_names is empty, the hostname of the peer will be used for matching against SAN/CN of peer’s certificate.
object
object
object
Exclusive with [default_session_key_caching disable_session_key_caching]
Number of session keys that are cached.
Exclusive with [disable_sni use_host_header_as_sni] SNI value to be used.
object
object
object
object
Exclusive with [no_request_limit_per_connection]
Sets the maximum number of requests allowed per connection to the origin server. Enter a value >=1 to define the request limit per connection.
object
Responses
Section titled “Responses”A successful response.
object
Examplegenerated
{}Returned when operation is not authorized.
Examplegenerated
exampleReturned when there is no permission to access resource.
Examplegenerated
exampleReturned when resource is not found.
Examplegenerated
exampleReturned when operation on resource is conflicting with current value.
Examplegenerated
exampleReturned when operation has been rejected as it is happening too frequently.
Examplegenerated
exampleReturned when server encountered an error in processing API.
Examplegenerated
exampleReturned when service is unavailable temporarily.
Examplegenerated
exampleReturned when server timed out processing request.
Examplegenerated
example