109 lines
4.1 KiB
YAML
109 lines
4.1 KiB
YAML
$schema: "http://json-schema.org/draft-06/schema#"
|
|
|
|
title: networksecurity v1beta1 TlsInspectionPolicy export schema
|
|
description: A gcloud export/import command YAML validation schema.
|
|
type: object
|
|
required:
|
|
- caPool
|
|
- name
|
|
additionalProperties: false
|
|
properties:
|
|
COMMENT:
|
|
type: object
|
|
description: User specified info ignored by gcloud import.
|
|
additionalProperties: false
|
|
properties:
|
|
template-id:
|
|
type: string
|
|
region:
|
|
type: string
|
|
description:
|
|
type: string
|
|
date:
|
|
type: string
|
|
version:
|
|
type: string
|
|
UNKNOWN:
|
|
type: array
|
|
description: Unknown API fields that cannot be imported.
|
|
items:
|
|
type: string
|
|
caPool:
|
|
description: |-
|
|
A CA pool resource used to issue interception certificates. The CA pool
|
|
string has a relative resource path following the form
|
|
"projects/{project}/locations/{location}/caPools/{ca_pool}".
|
|
type: string
|
|
customTlsFeatures:
|
|
description: |-
|
|
List of custom TLS cipher suites selected. This field is valid only if the
|
|
selected tls_feature_profile is CUSTOM. The
|
|
compute.SslPoliciesService.ListAvailableFeatures method returns the set of
|
|
features that can be specified in this list.
|
|
type: array
|
|
items:
|
|
type: string
|
|
description:
|
|
description: Free-text description of the resource.
|
|
type: string
|
|
excludePublicCaSet:
|
|
description: |-
|
|
If FALSE (the default), use our default set of public CAs in addition
|
|
to any CAs specified in trust_config. These public CAs are currently
|
|
based on the Mozilla Root Program and are subject to change over time.
|
|
If TRUE, do not accept our default set of public CAs. Only CAs
|
|
specified in trust_config will be accepted. This defaults to FALSE
|
|
(use public CAs in addition to trust_config) for backwards
|
|
compatibility, but trusting public root CAs is *not recommended*
|
|
unless the traffic in question is outbound to public web servers. When
|
|
possible, prefer setting this to "false" and explicitly specifying
|
|
trusted CAs and certificates in a TrustConfig. Note that Secure Web
|
|
Proxy does not yet honor this field.
|
|
type: boolean
|
|
minTlsVersion:
|
|
description: |-
|
|
Minimum TLS version that the firewall should use when negotiating
|
|
connections with both clients and servers. If this is not set, then
|
|
the default value is to allow the broadest set of clients and servers
|
|
(TLS 1.0 or higher). Setting this to more restrictive values may
|
|
improve security, but may also prevent the firewall from connecting to
|
|
some clients or servers. Note that Secure Web Proxy does not yet honor
|
|
this field.
|
|
type: string
|
|
enum:
|
|
- TLS_1_0
|
|
- TLS_1_1
|
|
- TLS_1_2
|
|
- TLS_1_3
|
|
- TLS_VERSION_UNSPECIFIED
|
|
name:
|
|
description: |-
|
|
Name of the resource. Name is of the form projects/{projec
|
|
t}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy}
|
|
tls_inspection_policy should match the
|
|
pattern:(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
|
|
type: string
|
|
tlsFeatureProfile:
|
|
description: |-
|
|
The selected Profile. If this is not set, then the default value is to
|
|
allow the broadest set of clients and servers ("PROFILE_COMPATIBLE").
|
|
Setting this to more restrictive values may improve security, but may
|
|
also prevent the TLS inspection proxy from connecting to some clients
|
|
or servers. Note that Secure Web Proxy does not yet honor this field.
|
|
type: string
|
|
enum:
|
|
- PROFILE_COMPATIBLE
|
|
- PROFILE_CUSTOM
|
|
- PROFILE_MODERN
|
|
- PROFILE_RESTRICTED
|
|
- PROFILE_UNSPECIFIED
|
|
trustConfig:
|
|
description: |-
|
|
A TrustConfig resource used when making a connection to the TLS
|
|
server. This is a relative resource path following the form
|
|
"projects/{project}/locations/{location}/trustConfigs/{trust_config}".
|
|
This is necessary to intercept TLS connections to servers with
|
|
certificates signed by a private CA or self-signed certificates. Note
|
|
that Secure Web Proxy does not yet honor this field.
|
|
type: string
|