mirrord-schema.json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "LayerFileConfig",
  "description": "mirrord allows for a high degree of customization when it comes to which features you want to enable, and how they should function.\n\nAll of the configuration fields have a default value, so a minimal configuration would be no configuration at all.\n\nThe configuration supports templating using the [Tera](https://keats.github.io/tera/docs/) template engine. Currently we don't provide additional values to the context, if you have anything you want us to provide please let us know.\n\nTo use a configuration file in the CLI, use the `-f <CONFIG_PATH>` flag. Or if using VSCode Extension or JetBrains plugin, simply create a `.mirrord/mirrord.json` file or use the UI.\n\nTo help you get started, here are examples of a basic configuration file, and a complete configuration file containing all fields.\n\n### Basic `config.json` {#root-basic}\n\n```json { \"target\": \"pod/bear-pod\", \"feature\": { \"env\": true, \"fs\": \"read\", \"network\": true } } ```\n\n### Basic `config.json` with templating {#root-basic-templating}\n\n```json { \"target\": \"{{ get_env(name=\"TARGET\", default=\"pod/fallback\") }}\", \"feature\": { \"env\": true, \"fs\": \"read\", \"network\": true } } ```\n\n### Complete `config.json` {#root-complete}\n\nDon't use this example as a starting point, it's just here to show you all the available options. ```json { \"accept_invalid_certificates\": false, \"skip_processes\": \"ide-debugger\", \"target\": { \"path\": \"pod/bear-pod\", \"namespace\": \"default\" }, \"connect_tcp\": null, \"agent\": { \"log_level\": \"info\", \"json_log\": false, \"labels\": { \"user\": \"meow\" }, \"annotations\": { \"cats.io/inject\": \"enabled\" }, \"namespace\": \"default\", \"image\": \"ghcr.io/metalbear-co/mirrord:latest\", \"image_pull_policy\": \"IfNotPresent\", \"image_pull_secrets\": [ { \"secret-key\": \"secret\" } ], \"ttl\": 30, \"ephemeral\": false, \"communication_timeout\": 30, \"startup_timeout\": 360, \"network_interface\": \"eth0\", \"flush_connections\": true }, \"feature\": { \"env\": { \"include\": \"DATABASE_USER;PUBLIC_ENV\", \"exclude\": \"DATABASE_PASSWORD;SECRET_ENV\", \"override\": { \"DATABASE_CONNECTION\": \"db://localhost:7777/my-db\", \"LOCAL_BEAR\": \"panda\" } }, \"fs\": { \"mode\": \"write\", \"read_write\": \".+\\\\.json\" , \"read_only\": [ \".+\\\\.yaml\", \".+important-file\\\\.txt\" ], \"local\": [ \".+\\\\.js\", \".+\\\\.mjs\" ] }, \"network\": { \"incoming\": { \"mode\": \"steal\", \"http_filter\": { \"header_filter\": \"host: api\\\\..+\" }, \"port_mapping\": [[ 7777, 8888 ]], \"ignore_localhost\": false, \"ignore_ports\": [9999, 10000] }, \"outgoing\": { \"tcp\": true, \"udp\": true, \"filter\": { \"local\": [\"tcp://1.1.1.0/24:1337\", \"1.1.5.0/24\", \"google.com\", \":53\"] }, \"ignore_localhost\": false, \"unix_streams\": \"bear.+\" }, \"dns\": false }, \"copy_target\": { \"scale_down\": false } }, \"operator\": true, \"kubeconfig\": \"~/.kube/config\", \"sip_binaries\": \"bash\", \"telemetry\": true, \"kube_context\": \"my-cluster\" } ```\n\n# Options {#root-options}",
  "type": "object",
  "properties": {
    "accept_invalid_certificates": {
      "title": "accept_invalid_certificates {#root-accept_invalid_certificates}",
      "description": "Controls whether or not mirrord accepts invalid TLS certificates (e.g. self-signed certificates).\n\nDefaults to `false`.",
      "type": [
        "boolean",
        "null"
      ]
    },
    "agent": {
      "title": "agent {#root-agent}",
      "anyOf": [
        {
          "$ref": "#/definitions/AgentFileConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "connect_tcp": {
      "title": "connect_tcp {#root-connect_tpc}",
      "description": "IP:PORT to connect to instead of using k8s api, for testing purposes.\n\n```json { \"connect_tcp\": \"10.10.0.100:7777\" } ```",
      "type": [
        "string",
        "null"
      ]
    },
    "experimental": {
      "title": "experimental {#root-experimental}",
      "anyOf": [
        {
          "$ref": "#/definitions/ExperimentalFileConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "feature": {
      "title": "feature {#root-feature}",
      "anyOf": [
        {
          "$ref": "#/definitions/FeatureFileConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "internal_proxy": {
      "title": "internal_proxy {#root-internal_proxy}",
      "anyOf": [
        {
          "$ref": "#/definitions/InternalProxyFileConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "kube_context": {
      "title": "kube_context {#root-kube_context}",
      "description": "Kube context to use from the kubeconfig file. Will use current context if not specified.\n\n```json { \"kube_context\": \"mycluster\" } ```",
      "type": [
        "string",
        "null"
      ]
    },
    "kubeconfig": {
      "title": "kubeconfig {#root-kubeconfig}",
      "description": "Path to a kubeconfig file, if not specified, will use `KUBECONFIG`, or `~/.kube/config`, or the in-cluster config.\n\n```json { \"kubeconfig\": \"~/bear/kube-config\" } ```",
      "type": [
        "string",
        "null"
      ]
    },
    "operator": {
      "title": "operator {#root-operator}",
      "description": "Whether mirrord should use the operator. If not set, mirrord will first attempt to use the operator, but continue without it in case of failure.",
      "type": [
        "boolean",
        "null"
      ]
    },
    "sip_binaries": {
      "title": "sip_binaries {#root-sip_binaries}",
      "description": "Binaries to patch (macOS SIP).\n\nUse this when mirrord isn't loaded to protected binaries that weren't automatically patched.\n\nRuns `endswith` on the binary path (so `bash` would apply to any binary ending with `bash` while `/usr/bin/bash` would apply only for that binary).\n\n```json { \"sip_binaries\": \"bash;python\" } ```",
      "anyOf": [
        {
          "$ref": "#/definitions/VecOrSingle_for_String"
        },
        {
          "type": "null"
        }
      ]
    },
    "skip_build_tools": {
      "title": "skip_build_tools {#root-skip_build_tools}",
      "description": "Allows mirrord to skip build tools. Useful when running command lines that build and run the application in a single command.\n\nDefaults to `true`.\n\nBuild-Tools: `[\"as\", \"cc\", \"ld\", \"go\", \"air\", \"asm\", \"cc1\", \"cgo\", \"dlv\", \"gcc\", \"git\", \"link\", \"math\", \"cargo\", \"hpack\", \"rustc\", \"compile\", \"collect2\", \"cargo-watch\", \"debugserver\"]`",
      "type": [
        "boolean",
        "null"
      ]
    },
    "skip_processes": {
      "title": "skip_processes {#root-skip_processes}",
      "description": "Allows mirrord to skip unwanted processes.\n\nUseful when process A spawns process B, and the user wants mirrord to operate only on process B. Accepts a single value, or multiple values separated by `;`.\n\n```json { \"skip_processes\": \"bash;node\" } ```",
      "anyOf": [
        {
          "$ref": "#/definitions/VecOrSingle_for_String"
        },
        {
          "type": "null"
        }
      ]
    },
    "target": {
      "title": "target {#root-target}",
      "anyOf": [
        {
          "$ref": "#/definitions/TargetFileConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "telemetry": {
      "title": "telemetry {#root-telemetry}",
      "description": "Controls whether or not mirrord sends telemetry data to MetalBear cloud. Telemetry sent doesn't contain personal identifiers or any data that should be considered sensitive. It is used to improve the product. [For more information](https://github.com/metalbear-co/mirrord/blob/main/TELEMETRY.md)",
      "type": [
        "boolean",
        "null"
      ]
    },
    "use_proxy": {
      "title": "use_proxy {#root-use_proxy}",
      "description": "When disabled, mirrord will remove `HTTP[S]_PROXY` env variables before doing any network requests. This is useful when the system sets a proxy but you don't want mirrord to use it. This also applies to the mirrord process (as it just removes the env). If the remote pod sets this env, the mirrord process will still use it.",
      "type": [
        "boolean",
        "null"
      ]
    }
  },
  "additionalProperties": false,
  "definitions": {
    "AdvancedFsUserConfig": {
      "description": "Allows the user to specify the default behavior for file operations:\n\n1. `\"read\"` - Read from the remote file system (default) 2. `\"write\"` - Read/Write from the remote file system. 3. `\"local\"` - Read from the local file system. 4. `\"localwithoverrides\"` - perform fs operation locally, unless the path matches a pre-defined or user-specified exception.\n\n> Note: by default, some paths are read locally or remotely, regardless of the selected FS mode. > This is described in further detail below.\n\nBesides the default behavior, the user can specify behavior for specific regex patterns. Case insensitive.\n\n1. `\"read_write\"` - List of patterns that should be read/write remotely. 2. `\"read_only\"` - List of patterns that should be read only remotely. 3. `\"local\"` - List of patterns that should be read locally. 4. `\"not_found\"` - List of patters that should never be read nor written. These files should be treated as non-existent.\n\nThe logic for choosing the behavior is as follows:\n\n1. Check if one of the patterns match the file path, do the corresponding action. There's no specified order if two lists match the same path, we will use the first one (and we do not guarantee what is first).\n\n**Warning**: Specifying the same path in two lists is unsupported and can lead to undefined behaviour.\n\n2. There are pre-defined exceptions to the set FS mode. 1. Paths that match [the patterns defined here](https://github.com/metalbear-co/mirrord/tree/latest/mirrord/layer/src/file/filter/read_local_by_default.rs) are read locally by default. 2. Paths that match [the patterns defined here](https://github.com/metalbear-co/mirrord/tree/latest/mirrord/layer/src/file/filter/read_remote_by_default.rs) are read remotely by default when the mode is `localwithoverrides`. 3. Paths that match [the patterns defined here](https://github.com/metalbear-co/mirrord/tree/latest/mirrord/layer/src/file/filter/not_found_by_default.rs) under the running user's home directory will not be found by the application when the mode is not `local`.\n\nIn order to override that default setting for a path, or a pattern, include it the appropriate pattern set from above. E.g. in order to read files under `/etc/` remotely even though it is covered by [the set of patterns that are read locally by default](https://github.com/metalbear-co/mirrord/tree/latest/mirrord/layer/src/file/filter/read_local_by_default.rs), add `\"^/etc/.\"` to the `read_only` set.\n\n3. If none of the above match, use the default behavior (mode).\n\nFor more information, check the file operations [technical reference](https://mirrord.dev/docs/reference/fileops/).\n\n```json { \"feature\": { \"fs\": { \"mode\": \"write\", \"read_write\": \".+\\\\.json\" , \"read_only\": [ \".+\\\\.yaml\", \".+important-file\\\\.txt\" ], \"local\": [ \".+\\\\.js\", \".+\\\\.mjs\" ], \"not_found\": [ \"\\\\.config/gcloud\" ] } } } ```",
      "type": "object",
      "properties": {
        "local": {
          "title": "feature.fs.local {#feature-fs-local}",
          "description": "Specify file path patterns that if matched will be opened locally.",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        },
        "mode": {
          "title": "feature.fs.mode {#feature-fs-mode}",
          "anyOf": [
            {
              "$ref": "#/definitions/FsModeConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "not_found": {
          "title": "feature.fs.not_found {#feature-fs-not_found}",
          "description": "Specify file path patterns that if matched will be treated as non-existent.",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        },
        "read_only": {
          "title": "feature.fs.read_only {#feature-fs-read_only}",
          "description": "Specify file path patterns that if matched will be read from the remote. if file matching the pattern is opened for writing or read/write it will be opened locally.",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        },
        "read_write": {
          "title": "feature.fs.read_write {#feature-fs-read_write}",
          "description": "Specify file path patterns that if matched will be read and written to the remote.",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "AgentFileConfig": {
      "description": "Configuration for the mirrord-agent pod that is spawned in the Kubernetes cluster.\n\nWe provide sane defaults for this option, so you don't have to set up anything here.\n\n```json { \"agent\": { \"log_level\": \"info\", \"json_log\": false, \"namespace\": \"default\", \"image\": \"ghcr.io/metalbear-co/mirrord:latest\", \"image_pull_policy\": \"IfNotPresent\", \"image_pull_secrets\": [ { \"secret-key\": \"secret\" } ], \"ttl\": 30, \"ephemeral\": false, \"communication_timeout\": 30, \"startup_timeout\": 360, \"network_interface\": \"eth0\", \"flush_connections\": false } } ```",
      "type": "object",
      "properties": {
        "annotations": {
          "title": "agent.annotations {#agent-annotations}",
          "description": "Allows setting up custom annotations for the agent Job and Pod.\n\n```json { \"annotations\": { \"cats.io/inject\": \"enabled\" } } ```",
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": {
            "type": "string"
          }
        },
        "check_out_of_pods": {
          "title": "agent.check_out_of_pods {#agent-check_out_of_pods}",
          "description": "Determine if to check whether there is room for agent job in target node. (Not applicable when using ephemeral containers feature)\n\nCan be disabled if the check takes too long and you are sure there is enough resources on each node",
          "type": [
            "boolean",
            "null"
          ]
        },
        "communication_timeout": {
          "title": "agent.communication_timeout {#agent-communication_timeout}",
          "description": "Controls how long the agent lives when there are no connections.\n\nEach connection has its own heartbeat mechanism, so even if the local application has no messages, the agent stays alive until there are no more heartbeat messages.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "minimum": 0.0
        },
        "disabled_capabilities": {
          "title": "agent.disabled_capabilities {#agent-disabled_capabilities}",
          "description": "Disables specified Linux capabilities for the agent container. If nothing is disabled here, agent uses `NET_ADMIN`, `NET_RAW`, `SYS_PTRACE` and `SYS_ADMIN`.",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "$ref": "#/definitions/LinuxCapability"
          }
        },
        "dns": {
          "title": "agent.dns {#agent-dns}",
          "anyOf": [
            {
              "$ref": "#/definitions/FileAgentDnsConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "ephemeral": {
          "title": "agent.ephemeral {#agent-ephemeral}",
          "description": "Runs the agent as an [ephemeral container](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/)\n\nDefaults to `false`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "flush_connections": {
          "title": "agent.flush_connections {#agent-flush_connections}",
          "description": "Flushes existing connections when starting to steal, might fix issues where connections aren't stolen (due to being already established)\n\nDefaults to `true`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "image": {
          "title": "agent.image {#agent-image}",
          "description": "Name of the agent's docker image.\n\nUseful when a custom build of mirrord-agent is required, or when using an internal registry.\n\nDefaults to the latest stable image `\"ghcr.io/metalbear-co/mirrord:latest\"`.\n\n```json { \"image\": \"internal.repo/images/mirrord:latest\" } ```\n\nComplete setup:\n\n```json { \"image\": { \"registry\": \"internal.repo/images/mirrord\", \"tag\": \"latest\" } } ```",
          "anyOf": [
            {
              "$ref": "#/definitions/AgentImageFileConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "image_pull_policy": {
          "title": "agent.image_pull_policy {#agent-image_pull_policy}",
          "description": "Controls when a new agent image is downloaded.\n\nSupports `\"IfNotPresent\"`, `\"Always\"`, `\"Never\"`, or any valid kubernetes [image pull policy](https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy)\n\nDefaults to `\"IfNotPresent\"`",
          "type": [
            "string",
            "null"
          ]
        },
        "image_pull_secrets": {
          "title": "agent.image_pull_secrets {#agent-image_pull_secrets}",
          "description": "List of secrets the agent pod has access to.\n\nTakes an array of entries with the format `{ name: <secret-name> }`.\n\nRead more [here](https://kubernetes.io/docs/concepts/containers/images/#referring-to-an-imagepullsecrets-on-a-pod).\n\n```json { \"agent\": { \"image_pull_secrets\": [ { \"name\": \"secret-key-1\" }, { \"name\": \"secret-key-2\" } ] } } ```",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "$ref": "#/definitions/AgentPullSecret"
          }
        },
        "json_log": {
          "title": "agent.json_log {#agent-json_log}",
          "description": "Controls whether the agent produces logs in a human-friendly format, or json.\n\n```json { \"agent\": { \"json_log\": true } } ```",
          "type": [
            "boolean",
            "null"
          ]
        },
        "labels": {
          "title": "agent.labels {#agent-labels}",
          "description": "Allows setting up custom labels for the agent Job and Pod.\n\n```json { \"labels\": { \"user\": \"meow\", \"state\": \"asleep\" } } ```",
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": {
            "type": "string"
          }
        },
        "log_level": {
          "title": "agent.log_level {#agent-log_level}",
          "description": "Log level for the agent.\n\nSupports `\"trace\"`, `\"debug\"`, `\"info\"`, `\"warn\"`, `\"error\"`, or any string that would work with `RUST_LOG`.\n\n```json { \"agent\": { \"log_level\": \"mirrord=debug,warn\" } } ```",
          "type": [
            "string",
            "null"
          ]
        },
        "namespace": {
          "title": "agent.namespace {#agent-namespace}",
          "description": "Namespace where the agent shall live. Note: Doesn't work with ephemeral containers. Defaults to the current kubernetes namespace.",
          "type": [
            "string",
            "null"
          ]
        },
        "network_interface": {
          "title": "agent.network_interface {#agent-network_interface}",
          "description": "Which network interface to use for mirroring.\n\nThe default behavior is try to access the internet and use that interface. If that fails it uses `eth0`.",
          "type": [
            "string",
            "null"
          ]
        },
        "nftables": {
          "title": "agent.nftables {#agent-nftables}",
          "description": "Use iptables-nft instead of iptables-legacy. Defaults to `false`.\n\nNeeded if your mesh uses nftables instead of iptables-legacy,",
          "type": [
            "boolean",
            "null"
          ]
        },
        "privileged": {
          "title": "agent.privileged {#agent-privileged}",
          "description": "Run the mirror agent as privileged container. Defaults to `false`.\n\nMight be needed in strict environments such as Bottlerocket.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "resources": {
          "title": "agent.resources {#agent-resources}",
          "description": "Set pod resource reqirements. (not with ephemeral agents) Default is ```json { \"requests\": { \"cpu\": \"1m\", \"memory\": \"1Mi\" }, \"limits\": { \"cpu\": \"100m\", \"memory\": \"100Mi\" } } ```",
          "anyOf": [
            {
              "$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements"
            },
            {
              "type": "null"
            }
          ]
        },
        "startup_timeout": {
          "title": "agent.startup_timeout {#agent-startup_timeout}",
          "description": "Controls how long to wait for the agent to finish initialization.\n\nIf initialization takes longer than this value, mirrord exits.\n\nDefaults to `60`.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint64",
          "minimum": 0.0
        },
        "tolerations": {
          "title": "agent.tolerations {#agent-tolerations}",
          "description": "Set pod tolerations. (not with ephemeral agents) Default is ```json [ { \"operator\": \"Exists\" } ] ```\n\nSet to an empty array to have no tolerations at all",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "$ref": "#/definitions/io.k8s.api.core.v1.Toleration"
          }
        },
        "ttl": {
          "title": "agent.ttl {#agent-ttl}",
          "description": "Controls how long the agent pod persists for after the agent exits (in seconds).\n\nCan be useful for collecting logs.\n\nDefaults to `1`.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint16",
          "minimum": 0.0
        }
      },
      "additionalProperties": false
    },
    "AgentImageFileConfig": {
      "description": "<!--${internal}--> Allows us to support the dual configuration for the agent image.\n\nWhatever values missing are replaced with our defaults.",
      "anyOf": [
        {
          "description": "The shortened version of: `image: \"repo/mirrord:latest\"`.",
          "type": [
            "string",
            "null"
          ]
        },
        {
          "description": "Expanded version: `image: { registry: \"repo/mirrord\", tag: \"latest\" }`.",
          "type": "object",
          "properties": {
            "registry": {
              "type": [
                "string",
                "null"
              ]
            },
            "tag": {
              "type": [
                "string",
                "null"
              ]
            }
          },
          "additionalProperties": false
        }
      ]
    },
    "AgentPullSecret": {
      "description": "<!--${internal}--> Specifies a secret reference for the agent pod.",
      "type": "object",
      "required": [
        "name"
      ],
      "properties": {
        "name": {
          "description": "Name of the secret.",
          "type": "string"
        }
      }
    },
    "ConcurrentSteal": {
      "description": "(Operator Only): Allows overriding port locks\n\nCan be set to either `\"continue\"` or `\"override\"`.\n\n- `\"continue\"`: Continue with normal execution - `\"override\"`: If port lock detected then override it with new lock and force close the original locking connection.",
      "oneOf": [
        {
          "description": "<!--${internal}--> ### override\n\nOverride any port lock and force close the original lock connection",
          "type": "string",
          "enum": [
            "override"
          ]
        },
        {
          "description": "<!--${internal}--> ### continue\n\nContinue with normal execution",
          "type": "string",
          "enum": [
            "continue"
          ]
        },
        {
          "description": "<!--${internal}--> ### abort\n\nAbort Execution when trying to steal traffic from a target whose traffic is already being stolen.",
          "type": "string",
          "enum": [
            "abort"
          ]
        }
      ]
    },
    "CopyTargetFileConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "object",
          "properties": {
            "scale_down": {
              "type": [
                "boolean",
                "null"
              ]
            }
          },
          "additionalProperties": false
        }
      ]
    },
    "DeploymentTarget": {
      "description": "<!--${internal}--> Mirror the deployment specified by [`DeploymentTarget::deployment`].",
      "type": "object",
      "required": [
        "deployment"
      ],
      "properties": {
        "container": {
          "type": [
            "string",
            "null"
          ]
        },
        "deployment": {
          "description": "<!--${internal}--> Deployment to mirror.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "EnvFileConfig": {
      "description": "Allows the user to set or override the local process' environment variables with the ones from the remote pod.\n\nWhich environment variables to load from the remote pod are controlled by setting either [`include`](#feature-env-include) or [`exclude`](#feature-env-exclude).\n\nSee the environment variables [reference](https://mirrord.dev/docs/reference/env/) for more details.\n\n```json { \"feature\": { \"env\": { \"include\": \"DATABASE_USER;PUBLIC_ENV;MY_APP_*\", \"exclude\": \"DATABASE_PASSWORD;SECRET_ENV\", \"override\": { \"DATABASE_CONNECTION\": \"db://localhost:7777/my-db\", \"LOCAL_BEAR\": \"panda\" } } } } ```",
      "type": "object",
      "properties": {
        "exclude": {
          "title": "feature.env.exclude {#feature-env-exclude}",
          "description": "Include the remote environment variables in the local process that are **NOT** specified by this option. Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of any character and `*` matches arbitrary many (including zero) occurrences of any character.\n\nSome of the variables that are excluded by default: `PATH`, `HOME`, `HOMEPATH`, `CLASSPATH`, `JAVA_EXE`, `JAVA_HOME`, `PYTHONPATH`.\n\nCan be passed as a list or as a semicolon-delimited string (e.g. `\"VAR;OTHER_VAR\"`).",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        },
        "include": {
          "title": "feature.env.include {#feature-env-include}",
          "description": "Include only these remote environment variables in the local process. Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of any character and `*` matches arbitrary many (including zero) occurrences of any character.\n\nCan be passed as a list or as a semicolon-delimited string (e.g. `\"VAR;OTHER_VAR\"`).\n\nSome environment variables are excluded by default (`PATH` for example), including these requires specifying them with `include`",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        },
        "load_from_process": {
          "title": "feature.env.load_from_process {#feature-env-load_from_process}",
          "description": "Allows for changing the way mirrord loads remote environment variables. If set, the variables are fetched after the user application is started.\n\nThis setting is meant to resolve issues when using mirrord via the IntelliJ plugin on WSL and the remote environment contains a lot of variables.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "override": {
          "title": "feature.env.override {#feature-env-override}",
          "description": "Allows setting or overriding environment variables (locally) with a custom value.\n\nFor example, if the remote pod has an environment variable `REGION=1`, but this is an undesirable value, it's possible to use `override` to set `REGION=2` (locally) instead.",
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": {
            "type": "string"
          }
        },
        "unset": {
          "title": "feature.env.unset {#feature-env-unset}",
          "description": "Allows unsetting environment variables in the executed process.\n\nThis is useful for when some system/user-defined environment like `AWS_PROFILE` make the application behave as if it's running locally, instead of using the remote settings. The unsetting happens from extension (if possible)/CLI and when process initializes. In some cases, such as Go the env might not be able to be modified from the process itself. This is case insensitive, meaning if you'd put `AWS_PROFILE` it'd unset both `AWS_PROFILE` and `Aws_Profile` and other variations.",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "ExperimentalFileConfig": {
      "description": "mirrord Experimental features. This shouldn't be used unless someone from MetalBear/mirrord tells you to.",
      "type": "object",
      "properties": {
        "readlink": {
          "title": "_experimental_ readlink {#fexperimental-readlink}",
          "description": "Enables the `readlink` hook.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "tcp_ping4_mock": {
          "title": "_experimental_ tcp_ping4_mock {#fexperimental-tcp_ping4_mock}",
          "description": "<https://github.com/metalbear-co/mirrord/issues/2421#issuecomment-2093200904>",
          "type": [
            "boolean",
            "null"
          ]
        }
      },
      "additionalProperties": false
    },
    "FeatureFileConfig": {
      "description": "Controls mirrord features.\n\nSee the [technical reference, Technical Reference](https://mirrord.dev/docs/reference/) to learn more about what each feature does.\n\nThe [`env`](#feature-env), [`fs`](#feature-fs) and [`network`](#feature-network) options have support for a shortened version, that you can see [here](#root-shortened).\n\n```json { \"feature\": { \"env\": { \"include\": \"DATABASE_USER;PUBLIC_ENV\", \"exclude\": \"DATABASE_PASSWORD;SECRET_ENV\", \"override\": { \"DATABASE_CONNECTION\": \"db://localhost:7777/my-db\", \"LOCAL_BEAR\": \"panda\" } }, \"fs\": { \"mode\": \"write\", \"read_write\": \".+\\\\.json\" , \"read_only\": [ \".+\\\\.yaml\", \".+important-file\\\\.txt\" ], \"local\": [ \".+\\\\.js\", \".+\\\\.mjs\" ] }, \"network\": { \"incoming\": { \"mode\": \"steal\", \"http_filter\": { \"header_filter\": \"host: api\\\\..+\" }, \"port_mapping\": [[ 7777, 8888 ]], \"ignore_localhost\": false, \"ignore_ports\": [9999, 10000] }, \"outgoing\": { \"tcp\": true, \"udp\": true, \"filter\": { \"local\": [\"tcp://1.1.1.0/24:1337\", \"1.1.5.0/24\", \"google.com\", \":53\"] }, \"ignore_localhost\": false, \"unix_streams\": \"bear.+\" }, \"dns\": false }, \"copy_target\": false, \"hostname\": true } } ```",
      "type": "object",
      "properties": {
        "copy_target": {
          "title": "feature.copy_target {#feature-copy_target}",
          "description": "Creates a new copy of the target. mirrord will use this copy instead of the original target (e.g. intercept network traffic). This feature requires a [mirrord operator](https://mirrord.dev/docs/overview/teams/).\n\nThis feature is not compatible with rollout targets and running without a target (`targetless` mode).",
          "anyOf": [
            {
              "$ref": "#/definitions/CopyTargetFileConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "env": {
          "title": "feature.env {#feature-env}",
          "anyOf": [
            {
              "$ref": "#/definitions/ToggleableConfig_for_EnvFileConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "fs": {
          "title": "feature.fs {#feature-fs}",
          "anyOf": [
            {
              "$ref": "#/definitions/ToggleableConfig_for_FsUserConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "hostname": {
          "title": "feature.hostname {#feature-hostname}",
          "description": "Should mirrord return the hostname of the target pod when calling `gethostname`",
          "type": [
            "boolean",
            "null"
          ]
        },
        "network": {
          "title": "feature.network {#feature-network}",
          "anyOf": [
            {
              "$ref": "#/definitions/ToggleableConfig_for_NetworkFileConfig"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "FileAgentDnsConfig": {
      "type": "object",
      "properties": {
        "attempts": {
          "title": "agent.dns.attempts {#agent-dns-attempts}",
          "description": "When agent resolves DNS, how many attempts before failing. If the value is too high, it might cause internal proxy to timeout and exit.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint32",
          "minimum": 0.0
        },
        "timeout": {
          "title": "agent.dns.timeout {#agent-dns-timeout}",
          "description": "When agent resolves DNS, how long to wait for a response before timeout By default this is set to 1 (in the agent). If the value is too high, it might cause internal proxy to timeout and exit.",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint32",
          "minimum": 0.0
        }
      },
      "additionalProperties": false
    },
    "FsModeConfig": {
      "description": "Configuration for enabling read-only or read-write file operations.\n\nThese options are overriden by user specified overrides and mirrord default overrides.\n\nIf you set [`\"localwithoverrides\"`](#feature-fs-mode-localwithoverrides) then some files can be read/write remotely based on our default/user specified. Default option for general file configuration.\n\nThe accepted values are: `\"local\"`, `\"localwithoverrides`, `\"read\"`, or `\"write`.",
      "oneOf": [
        {
          "title": "feature.fs.mode.local {#feature-fs-mode-local}",
          "description": "mirrord won't do anything fs-related, all operations will be local.",
          "type": "string",
          "enum": [
            "local"
          ]
        },
        {
          "title": "feature.fs.mode.localwithoverrides {#feature-fs-mode-localwithoverrides}",
          "description": "mirrord will run overrides on some file operations, but most will be local.",
          "type": "string",
          "enum": [
            "localwithoverrides"
          ]
        },
        {
          "title": "feature.fs.mode.read {#feature-fs-mode-read}",
          "description": "mirrord will read files from the remote, but won't write to them.",
          "type": "string",
          "enum": [
            "read"
          ]
        },
        {
          "title": "feature.fs.mode.write {#feature-fs-mode-write}",
          "description": "mirrord will read/write from the remote.",
          "type": "string",
          "enum": [
            "write"
          ]
        }
      ]
    },
    "FsUserConfig": {
      "title": "feature.fs {#fs}",
      "description": "Changes file operations behavior based on user configuration.\n\nSee the file operations [reference](https://mirrord.dev/docs/reference/fileops/) for more details, and [fs advanced](#fs-advanced) for more information on how to fully setup mirrord file operations.\n\n### Minimal `fs` config {#fs-minimal}\n\n```json { \"feature\": { \"fs\": \"read\" } } ```\n\n### Advanced `fs` config {#fs-advanced}\n\n```json { \"feature\": { \"fs\": { \"mode\": \"write\", \"read_write\": \".+\\\\.json\" , \"read_only\": [ \".+\\\\.yaml\", \".+important-file\\\\.txt\" ], \"local\": [ \".+\\\\.js\", \".+\\\\.mjs\" ] } } } ```",
      "anyOf": [
        {
          "description": "<!--${internal}--> Basic configuration that controls the env vars `MIRRORD_FILE_OPS` and `MIRRORD_FILE_RO_OPS` (default).",
          "allOf": [
            {
              "$ref": "#/definitions/FsModeConfig"
            }
          ]
        },
        {
          "description": "<!--${internal}--> Allows the user to specify both [`FsModeConfig`] (as above), and configuration for the overrides.",
          "allOf": [
            {
              "$ref": "#/definitions/AdvancedFsUserConfig"
            }
          ]
        }
      ]
    },
    "HttpFilterFileConfig": {
      "description": "Filter configuration for the HTTP traffic stealer feature.\n\nAllows the user to set a filter (regex) for the HTTP headers, so that the stealer traffic feature only captures HTTP requests that match the specified filter, forwarding unmatched requests to their original destinations.\n\nOnly does something when [`feature.network.incoming.mode`](#feature-network-incoming-mode) is set as `\"steal\"`, ignored otherwise.\n\nFor example, to filter based on header: ```json { \"header_filter\": \"host: api\\\\..+\" } ``` Setting that filter will make mirrord only steal requests with the `host` header set to hosts that start with \"api\", followed by a dot, and then at least one more character.\n\nFor example, to filter based on path: ```json { \"path_filter\": \"^/api/\" } ``` Setting this filter will make mirrord only steal requests to URIs starting with \"/api/\".\n\nThis can be useful for filtering out Kubernetes liveness, readiness and startup probes. For example, for avoiding stealing any probe sent by kubernetes, you can set this filter: ```json { \"header_filter\": \"^User-Agent: (?!kube-probe)\" } ``` Setting this filter will make mirrord only steal requests that **do** have a user agent that **does not** begin with \"kube-probe\".\n\nSimilarly, you can exclude certain paths using a negative look-ahead: ```json { \"path_filter\": \"^(?!/health/)\" } ``` Setting this filter will make mirrord only steal requests to URIs that do not start with \"/health/\".",
      "type": "object",
      "properties": {
        "header_filter": {
          "title": "feature.network.incoming.http_filter.header_filter {#feature-network-incoming-http-header-filter}",
          "description": "Supports regexes validated by the [`fancy-regex`](https://docs.rs/fancy-regex/latest/fancy_regex/) crate.\n\nThe HTTP traffic feature converts the HTTP headers to `HeaderKey: HeaderValue`, case-insensitive.",
          "type": [
            "string",
            "null"
          ]
        },
        "path_filter": {
          "title": "feature.network.incoming.http_filter.path_filter {#feature-network-incoming-http-path-filter}",
          "description": "Supports regexes validated by the [`fancy-regex`](https://docs.rs/fancy-regex/latest/fancy_regex/) crate.\n\nCase-insensitive.",
          "type": [
            "string",
            "null"
          ]
        },
        "ports": {
          "title": "feature.network.incoming.http_filter.ports {#feature-network-incoming-http_filter-ports}",
          "description": "Activate the HTTP traffic filter only for these ports.\n\nOther ports will *not* be stolen, unless listed in [`feature.network.incoming.ports`](#feature-network-incoming-ports).\n\nSet to [80, 8080] by default.",
          "anyOf": [
            {
              "$ref": "#/definitions/PortList"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "IncomingAdvancedFileConfig": {
      "title": "incoming (advanced setup)",
      "description": "Advanced user configuration for network incoming traffic.",
      "type": "object",
      "properties": {
        "http_filter": {
          "title": "HTTP Filter",
          "description": "Sets up the HTTP traffic filter (currently, only useful when `incoming: steal`).\n\nSee [`filter`](##filter) for details.",
          "anyOf": [
            {
              "$ref": "#/definitions/ToggleableConfig_for_HttpFilterFileConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "ignore_localhost": {
          "title": "ignore_localhost",
          "description": "Consider removing when adding <https://github.com/metalbear-co/mirrord/issues/702>",
          "type": [
            "boolean",
            "null"
          ]
        },
        "ignore_ports": {
          "title": "ignore_ports",
          "description": "Ports to ignore when mirroring/stealing traffic. Useful if you want specific ports to be used locally only.\n\nMutually exclusive with [`ports`](###ports).",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "integer",
            "format": "uint16",
            "minimum": 0.0
          }
        },
        "listen_ports": {
          "title": "listen_ports",
          "description": "Mapping for local ports to actually used local ports. When application listens on a port while steal/mirror is active we fallback to random ports to avoid port conflicts. Using this configuration will always use the specified port. If this configuration doesn't exist, mirrord will try to listen on the original port and if it fails it will assign a random port\n\nThis is useful when you want to access ports exposed by your service locally For example, if you have a service that listens on port `80` and you want to access it, you probably can't listen on `80` without sudo, so you can use `[[80, 4480]]` then access it on `4480` while getting traffic from remote `80`. The value of `port_mapping` doesn't affect this.",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "array",
            "items": [
              {
                "type": "integer",
                "format": "uint16",
                "minimum": 0.0
              },
              {
                "type": "integer",
                "format": "uint16",
                "minimum": 0.0
              }
            ],
            "maxItems": 2,
            "minItems": 2
          }
        },
        "mode": {
          "title": "mode",
          "description": "Allows selecting between mirrorring or stealing traffic.\n\nSee [`mode`](##mode (incoming)) for details.",
          "anyOf": [
            {
              "$ref": "#/definitions/IncomingMode"
            },
            {
              "type": "null"
            }
          ]
        },
        "on_concurrent_steal": {
          "title": "on_concurrent_steal",
          "description": "(Operator Only): if value of override will force close any other connections on requested target",
          "anyOf": [
            {
              "$ref": "#/definitions/ConcurrentSteal"
            },
            {
              "type": "null"
            }
          ]
        },
        "port_mapping": {
          "title": "port_mapping",
          "description": "Mapping for local ports to remote ports.\n\nThis is useful when you want to mirror/steal a port to a different port on the remote machine. For example, your local process listens on port `9333` and the container listens on port `80`. You'd use `[[9333, 80]]`",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "array",
            "items": [
              {
                "type": "integer",
                "format": "uint16",
                "minimum": 0.0
              },
              {
                "type": "integer",
                "format": "uint16",
                "minimum": 0.0
              }
            ],
            "maxItems": 2,
            "minItems": 2
          }
        },
        "ports": {
          "title": "ports",
          "description": "List of ports to mirror/steal traffic from. Other ports will remain local.\n\nMutually exclusive with [`ignore_ports`](###ignore_ports).",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "integer",
            "format": "uint16",
            "minimum": 0.0
          }
        }
      },
      "additionalProperties": false
    },
    "IncomingFileConfig": {
      "title": "incoming (network)",
      "description": "Controls the incoming TCP traffic feature.\n\nSee the incoming [reference](https://mirrord.dev/docs/reference/traffic/#incoming) for more details.\n\nIncoming traffic supports 2 modes of operation:\n\n1. Mirror (**default**): Sniffs the TCP data from a port, and forwards a copy to the interested listeners;\n\n2. Steal: Captures the TCP data from a port, and forwards it to the local process, see [`steal`](##steal);\n\n### Minimal `incoming` config\n\n```json { \"feature\": { \"network\": { \"incoming\": \"steal\" } } } ```\n\n### Advanced `incoming` config\n\n```json { \"feature\": { \"network\": { \"incoming\": { \"mode\": \"steal\", \"http_filter\": { \"header_filter\": \"host: api\\\\..+\" }, \"port_mapping\": [[ 7777, 8888 ]], \"ignore_localhost\": false, \"ignore_ports\": [9999, 10000] \"listen_ports\": [[80, 8111]] } } } } ```",
      "anyOf": [
        {
          "anyOf": [
            {
              "$ref": "#/definitions/IncomingMode"
            },
            {
              "type": "null"
            }
          ]
        },
        {
          "$ref": "#/definitions/IncomingAdvancedFileConfig"
        }
      ]
    },
    "IncomingMode": {
      "description": "Allows selecting between mirrorring or stealing traffic.\n\nCan be set to either `\"mirror\"` (default), `\"steal\"` or `\"off\"`.\n\n- `\"mirror\"`: Sniffs on TCP port, and send a copy of the data to listeners. - `\"off\"`: Disables the incoming network feature. - `\"steal\"`: Supports 2 modes of operation:\n\n1. Port traffic stealing: Steals all TCP data from a port, which is selected whenever the user listens in a TCP socket (enabling the feature is enough to make this work, no additional configuration is needed);\n\n2. HTTP traffic stealing: Steals only HTTP traffic, mirrord tries to detect if the incoming data on a port is HTTP (in a best-effort kind of way, not guaranteed to be HTTP), and steals the traffic on the port if it is HTTP;",
      "oneOf": [
        {
          "description": "<!--${internal}--> ### mirror\n\nSniffs on TCP port, and send a copy of the data to listeners.",
          "type": "string",
          "enum": [
            "mirror"
          ]
        },
        {
          "description": "<!--${internal}--> ### steal\n\nStealer supports 2 modes of operation:\n\n1. Port traffic stealing: Steals all TCP data from a port, which is selected whenever the user listens in a TCP socket (enabling the feature is enough to make this work, no additional configuration is needed);\n\n2. HTTP traffic stealing: Steals only HTTP traffic, mirrord tries to detect if the incoming data on a port is HTTP (in a best-effort kind of way, not guaranteed to be HTTP), and steals the traffic on the port if it is HTTP;",
          "type": "string",
          "enum": [
            "steal"
          ]
        },
        {
          "description": "<!--${internal}--> ### Off\n\nDisables the incoming network feature.",
          "type": "string",
          "enum": [
            "off"
          ]
        }
      ]
    },
    "InternalProxyFileConfig": {
      "description": "Configuration for the internal proxy mirrord spawns for each local mirrord session that local layers use to connect to the remote agent\n\nThis is seldom used, but if you get `ConnectionRefused` errors, you might want to increase the timeouts a bit.\n\n```json { \"internal_proxy\": { \"start_idle_timeout\": 30, \"idle_timeout\": 5 } } ```",
      "type": "object",
      "properties": {
        "idle_timeout": {
          "title": "internal_proxy.idle_timeout {#internal_proxy-idle_timeout}",
          "description": "How much time to wait while we don't have any active connections before exiting.\n\nCommon cases would be running a chain of processes that skip using the layer and don't connect to the proxy.\n\n```json { \"internal_proxy\": { \"idle_timeout\": 30 } } ```",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint64",
          "minimum": 0.0
        },
        "log_destination": {
          "title": "internal_proxy.log_destination {#internal_proxy-log_destination}",
          "description": "Set the log file destination for the internal proxy.",
          "type": [
            "string",
            "null"
          ]
        },
        "log_level": {
          "title": "internal_proxy.log_level {#internal_proxy-log_level}",
          "description": "Set the log level for the internal proxy. RUST_LOG convention (i.e `mirrord=trace`) will only be used if log_destination is set",
          "type": [
            "string",
            "null"
          ]
        },
        "start_idle_timeout": {
          "title": "internal_proxy.start_idle_timeout {#internal_proxy-start_idle_timeout}",
          "description": "How much time to wait for the first connection to the proxy in seconds.\n\nCommon cases would be running with dlv or any other debugger, which sets a breakpoint on process execution, delaying the layer startup and connection to proxy.\n\n```json { \"internal_proxy\": { \"start_idle_timeout\": 60 } } ```",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint64",
          "minimum": 0.0
        }
      },
      "additionalProperties": false
    },
    "JobTarget": {
      "type": "object",
      "required": [
        "job"
      ],
      "properties": {
        "container": {
          "type": [
            "string",
            "null"
          ]
        },
        "job": {
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "LinuxCapability": {
      "type": "string",
      "enum": [
        "SYS_ADMIN",
        "SYS_PTRACE",
        "NET_RAW",
        "NET_ADMIN"
      ]
    },
    "NetworkFileConfig": {
      "description": "Controls mirrord network operations.\n\nSee the network traffic [reference](https://mirrord.dev/docs/reference/traffic/) for more details.\n\n```json { \"feature\": { \"network\": { \"incoming\": { \"mode\": \"steal\", \"http_filter\": { \"header_filter\": \"host: api\\\\..+\" }, \"port_mapping\": [[ 7777, 8888 ]], \"ignore_localhost\": false, \"ignore_ports\": [9999, 10000] }, \"outgoing\": { \"tcp\": true, \"udp\": true, \"filter\": { \"local\": [\"tcp://1.1.1.0/24:1337\", \"1.1.5.0/24\", \"google.com\", \":53\"] }, \"ignore_localhost\": false, \"unix_streams\": \"bear.+\" }, \"dns\": false } } } ```",
      "type": "object",
      "properties": {
        "dns": {
          "title": "feature.network.dns {#feature-network-dns}",
          "description": "Resolve DNS via the remote pod.\n\nDefaults to `true`.\n\n- Caveats: DNS resolving can be done in multiple ways, some frameworks will use `getaddrinfo`, while others will create a connection on port `53` and perform a sort of manual resolution. Just enabling the `dns` feature in mirrord might not be enough. If you see an address resolution error, try enabling the [`fs`](#feature-fs) feature, and setting `read_only: [\"/etc/resolv.conf\"]`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "incoming": {
          "title": "feature.network.incoming {#feature-network-incoming}",
          "anyOf": [
            {
              "$ref": "#/definitions/ToggleableConfig_for_IncomingFileConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "outgoing": {
          "title": "feature.network.outgoing {#feature-network-outgoing}",
          "anyOf": [
            {
              "$ref": "#/definitions/ToggleableConfig_for_OutgoingFileConfig"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "OutgoingFileConfig": {
      "description": "Tunnel outgoing network operations through mirrord.\n\nSee the outgoing [reference](https://mirrord.dev/docs/reference/traffic/#outgoing) for more details.\n\nThe `remote` and `local` config for this feature are **mutually** exclusive.\n\n```json { \"feature\": { \"network\": { \"outgoing\": { \"tcp\": true, \"udp\": true, \"ignore_localhost\": false, \"filter\": { \"local\": [\"tcp://1.1.1.0/24:1337\", \"1.1.5.0/24\", \"google.com\", \":53\"] }, \"unix_streams\": \"bear.+\" } } } } ```",
      "type": "object",
      "properties": {
        "filter": {
          "title": "feature.network.outgoing.filter {#feature.network.outgoing.filter}",
          "description": "Unstable: the precise syntax of this config is subject to change.",
          "anyOf": [
            {
              "$ref": "#/definitions/OutgoingFilterConfig"
            },
            {
              "type": "null"
            }
          ]
        },
        "ignore_localhost": {
          "title": "feature.network.outgoing.ignore_localhost {#feature.network.outgoing.ignore_localhost}",
          "description": "Defaults to `false`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "tcp": {
          "title": "feature.network.outgoing.tcp {#feature.network.outgoing.tcp}",
          "description": "Defaults to `true`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "udp": {
          "title": "feature.network.outgoing.udp {#feature.network.outgoing.udp}",
          "description": "Defaults to `true`.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "unix_streams": {
          "title": "feature.network.outgoing.unix_streams {#feature.network.outgoing.unix_streams}",
          "description": "Connect to these unix streams remotely (and to all other paths locally).\n\nYou can either specify a single value or an array of values. Each value is interpreted as a regular expression ([Supported Syntax](https://docs.rs/regex/1.7.1/regex/index.html#syntax)).\n\nWhen your application connects to a unix socket, the target address will be converted to a string (non-utf8 bytes are replaced by a placeholder character) and matched against the set of regexes specified here. If there is a match, mirrord will connect your application with the target unix socket address on the target pod. Otherwise, it will leave the connection to happen locally on your machine.",
          "anyOf": [
            {
              "$ref": "#/definitions/VecOrSingle_for_String"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "additionalProperties": false
    },
    "OutgoingFilterConfig": {
      "description": "List of addresses/ports/subnets that should be sent through either the remote pod or local app, depending how you set this up with either `remote` or `local`.\n\nYou may use this option to specify when outgoing traffic is sent from the remote pod (which is the default behavior when you enable outgoing traffic), or from the local app (default when you have outgoing traffic disabled).\n\nTakes a list of values, such as:\n\n- Only UDP traffic on subnet `1.1.1.0/24` on port 1337 will go through the remote pod.\n\n```json { \"remote\": [\"udp://1.1.1.0/24:1337\"] } ```\n\n- Only UDP and TCP traffic on resolved address of `google.com` on port `1337` and `7331` will go through the remote pod. ```json { \"remote\": [\"google.com:1337\", \"google.com:7331\"] } ```\n\n- Only TCP traffic on `localhost` on port 1337 will go through the local app, the rest will be emmited remotely in the cluster.\n\n```json { \"local\": [\"tcp://localhost:1337\"] } ```\n\n- Only outgoing traffic on port `1337` and `7331` will go through the local app. ```json { \"local\": [\":1337\", \":7331\"] } ```\n\nValid values follow this pattern: `[protocol]://[name|address|subnet/mask]:[port]`.",
      "oneOf": [
        {
          "description": "Traffic that matches what's specified here will go through the remote pod, everything else will go through local.",
          "type": "object",
          "required": [
            "remote"
          ],
          "properties": {
            "remote": {
              "$ref": "#/definitions/VecOrSingle_for_String"
            }
          },
          "additionalProperties": false
        },
        {
          "description": "Traffic that matches what's specified here will go through the local app, everything else will go through the remote pod.",
          "type": "object",
          "required": [
            "local"
          ],
          "properties": {
            "local": {
              "$ref": "#/definitions/VecOrSingle_for_String"
            }
          },
          "additionalProperties": false
        }
      ]
    },
    "PodTarget": {
      "description": "<!--${internal}--> Mirror the pod specified by [`PodTarget::pod`].",
      "type": "object",
      "required": [
        "pod"
      ],
      "properties": {
        "container": {
          "type": [
            "string",
            "null"
          ]
        },
        "pod": {
          "description": "<!--${internal}--> Pod to mirror.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "PortList": {
      "description": "<!--${internal}--> Helper struct for setting up ports configuration (part of the HTTP traffic stealer feature).\n\nDefaults to a list of ports `[80, 8080]`.\n\nWe use this to allow implementing a custom [`Default`] initialization, as the [`MirrordConfig`] macro (currently) doesn't support more intricate expressions.",
      "allOf": [
        {
          "$ref": "#/definitions/VecOrSingle_for_uint16"
        }
      ]
    },
    "RolloutTarget": {
      "description": "<!--${internal}--> Mirror the rollout specified by [`RolloutTarget::rollout`].",
      "type": "object",
      "required": [
        "rollout"
      ],
      "properties": {
        "container": {
          "type": [
            "string",
            "null"
          ]
        },
        "rollout": {
          "description": "<!--${internal}--> Rollout to mirror.",
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "Target": {
      "description": "<!--${internal}--> ## path\n\nSpecifies the running pod (or deployment) to mirror.\n\nSupports: - `pod/{sample-pod}`; - `podname/{sample-pod}`; - `deployment/{sample-deployment}`; - `container/{sample-container}`; - `containername/{sample-container}`. - `job/{sample-job}`;",
      "anyOf": [
        {
          "description": "<!--${internal}--> Mirror a deployment.",
          "allOf": [
            {
              "$ref": "#/definitions/DeploymentTarget"
            }
          ]
        },
        {
          "description": "<!--${internal}--> Mirror a pod.",
          "allOf": [
            {
              "$ref": "#/definitions/PodTarget"
            }
          ]
        },
        {
          "description": "<!--${internal}--> Mirror a rollout.",
          "allOf": [
            {
              "$ref": "#/definitions/RolloutTarget"
            }
          ]
        },
        {
          "description": "<!--${internal}--> Mirror a Job.\n\nOnly supported when `copy_target` is enabled.",
          "allOf": [
            {
              "$ref": "#/definitions/JobTarget"
            }
          ]
        },
        {
          "description": "<!--${internal}--> Spawn a new pod.",
          "type": "null"
        }
      ]
    },
    "TargetFileConfig": {
      "anyOf": [
        {
          "anyOf": [
            {
              "$ref": "#/definitions/Target"
            },
            {
              "type": "null"
            },
            {
              "type": "string"
            }
          ]
        },
        {
          "type": "object",
          "properties": {
            "namespace": {
              "type": [
                "string",
                "null"
              ]
            },
            "path": {
              "description": "<!--${internal}--> Path is optional so that it can also be specified via env var instead of via conf file, but it is not optional in a resulting [`TargetConfig`] object - either there is a path, or the target configuration is `None`.",
              "default": null,
              "anyOf": [
                {
                  "$ref": "#/definitions/Target"
                },
                {
                  "type": "null"
                }
              ]
            }
          },
          "additionalProperties": false
        }
      ]
    },
    "ToggleableConfig_for_EnvFileConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "$ref": "#/definitions/EnvFileConfig"
        }
      ]
    },
    "ToggleableConfig_for_FsUserConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "$ref": "#/definitions/FsUserConfig"
        }
      ]
    },
    "ToggleableConfig_for_HttpFilterFileConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "$ref": "#/definitions/HttpFilterFileConfig"
        }
      ]
    },
    "ToggleableConfig_for_IncomingFileConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "$ref": "#/definitions/IncomingFileConfig"
        }
      ]
    },
    "ToggleableConfig_for_NetworkFileConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "$ref": "#/definitions/NetworkFileConfig"
        }
      ]
    },
    "ToggleableConfig_for_OutgoingFileConfig": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "$ref": "#/definitions/OutgoingFileConfig"
        }
      ]
    },
    "VecOrSingle_for_String": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ]
    },
    "VecOrSingle_for_uint16": {
      "anyOf": [
        {
          "type": "integer",
          "format": "uint16",
          "minimum": 0.0
        },
        {
          "type": "array",
          "items": {
            "type": "integer",
            "format": "uint16",
            "minimum": 0.0
          }
        }
      ]
    },
    "io.k8s.api.core.v1.ResourceRequirements": {
      "description": "ResourceRequirements describes the compute resource requirements.",
      "type": "object",
      "properties": {
        "limits": {
          "description": "Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
          }
        },
        "requests": {
          "description": "Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
          "type": "object",
          "additionalProperties": {
            "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity"
          }
        }
      }
    },
    "io.k8s.api.core.v1.Toleration": {
      "description": "The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.",
      "type": "object",
      "properties": {
        "effect": {
          "description": "Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.\n\n",
          "type": "string"
        },
        "key": {
          "description": "Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.",
          "type": "string"
        },
        "operator": {
          "description": "Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.\n\n",
          "type": "string"
        },
        "tolerationSeconds": {
          "description": "TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.",
          "type": "integer",
          "format": "int64"
        },
        "value": {
          "description": "Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.",
          "type": "string"
        }
      }
    },
    "io.k8s.apimachinery.pkg.api.resource.Quantity": {
      "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n<quantity>        ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber>\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n\ta. No precision is lost\n\tb. No fractional digits will be emitted\n\tc. The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n\t1.5 will be serialized as \"1500m\"\n\t1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
      "type": "string"
    }
  }
}