package istio.attributegen

AttributeGeneration define generation of one attribute.

Phase phase = 1
Phase denotes plugin lifecycle phase when the new attribute is generated. Default: After the response is sent back to the client. $hide_from_docs
string output_attribute = 2
The name of the attribute that is populated on a successful match. An attribute name SHOULD NOT contain a `.`. You may use underscores for namespacing instead. Example: `istio_operationId` `istio_` attribute namespace is reserved by Istio. AttributeGeneration may fail to evaluate when an attribute is not available. For example, `response.code` may not be available when a request ends abruptly. When attribute generation fails, it will not populate the attribute. If the generated attribute is used by an authz plugin, it should account for the possibility that the attribute may be missing. Use `has(attribute_name)` function to check for presence of an attribute before using its value, and provide appropriate defaults. For example the following is a safe use of `response.code` `has(response.code)?response.code:200`
repeated Match match = 3
Matches are evaluated in order until the first successful match. The value specified by the successful match is assgined to the output_attribute.

If the condition evaluates to true then the Match returns the specified value.

string condition = 1
The condition is a [CEL expression](https://github.com/google/cel-spec/blob/master/doc/langdef.md) that may use [builtin attributes](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/advanced/attributes#attributes). Example: {{<tabset category-name="example">}} {{<tab name="attribute-match" >}} ```yaml { "value": "GetBook", "condition": "request.url_path.matches('^/shelves/[[:alnum:]]*/books/[[:alnum:]]*$') && request.method == 'GET'" }, ``` Note: CEL uses [re2](https://github.com/google/re2/wiki/Syntax) regex library. Use anchors `{^, $}` to ensure that the regex evaluates efficiently. Note: `request.url_path` is normalized and stripped of query params. a Read only operation on books ```yaml { "value": "ReadOnlyBooks", "condition": "request.url_path.startsWith('/books/') && in(request.method, ['GET', 'HEAD'])"} ``` {{</tab>}} {{</tabset>}} An empty condition evaluates to `true` and should be used to provide a default value.
string value = 2
If condition evaluates to true, return the `value`.

Phase determines when the classification is performed. $hide_from_docs

PHASE_UNSPECIFIED = 0
AttributeGeneration is performed after the response is sent back to the client. All information about the request is available in this phase, and classification does not add to the latency observed by the client. $hide_from_docs
AFTER_RESPONSE = 0
$hide_from_docs
ON_REQUEST = 1
AttributeGeneration is performed during request processing, and adds to the request latency as observed by the client. Only request related information can be used in this phase. For example: you may not use response headers here. Attemping to use response headers in request phase will never result in a match. $hide_from_docs

Top level configuration to generate new attributes based on attributes of the proxied traffic.

bool debug = 1
The following settings should be rarely used. Enable debug for this filter.
repeated AttributeGeneration attributes = 2
Multiple independent attribute generation configurations.

message AttributeGeneration