[OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

proto-public/pbmesh/v1alpha1/access_logs.pb.binary.go

@@ -0,0 +1,18 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/access_logs.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *AccessLogs) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *AccessLogs) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/access_logs.pb.go

@@ -0,0 +1,319 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/access_logs.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type LogSinkType int32
+
+const (
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	LogSinkType_LOG_SINK_TYPE_DEFAULT LogSinkType = 0
+	LogSinkType_LOG_SINK_TYPE_FILE    LogSinkType = 1
+	LogSinkType_LOG_SINK_TYPE_STDERR  LogSinkType = 2
+	LogSinkType_LOG_SINK_TYPE_STDOUT  LogSinkType = 3
+)
+
+// Enum value maps for LogSinkType.
+var (
+	LogSinkType_name = map[int32]string{
+		0: "LOG_SINK_TYPE_DEFAULT",
+		1: "LOG_SINK_TYPE_FILE",
+		2: "LOG_SINK_TYPE_STDERR",
+		3: "LOG_SINK_TYPE_STDOUT",
+	}
+	LogSinkType_value = map[string]int32{
+		"LOG_SINK_TYPE_DEFAULT": 0,
+		"LOG_SINK_TYPE_FILE":    1,
+		"LOG_SINK_TYPE_STDERR":  2,
+		"LOG_SINK_TYPE_STDOUT":  3,
+	}
+)
+
+func (x LogSinkType) Enum() *LogSinkType {
+	p := new(LogSinkType)
+	*p = x
+	return p
+}
+
+func (x LogSinkType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (LogSinkType) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbmesh_v1alpha1_access_logs_proto_enumTypes[0].Descriptor()
+}
+
+func (LogSinkType) Type() protoreflect.EnumType {
+	return &file_pbmesh_v1alpha1_access_logs_proto_enumTypes[0]
+}
+
+func (x LogSinkType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use LogSinkType.Descriptor instead.
+func (LogSinkType) EnumDescriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_access_logs_proto_rawDescGZIP(), []int{0}
+}
+
+type AccessLogs struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// enabled enables access logging.
+	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// disable_listener_logs turns off just listener logs for connections rejected by Envoy because they don't
+	// have a matching listener filter.
+	DisableListenerLogs bool `protobuf:"varint,2,opt,name=disable_listener_logs,json=disableListenerLogs,proto3" json:"disable_listener_logs,omitempty"`
+	// type selects the output for logs: "file", "stderr". "stdout"
+	Type LogSinkType `protobuf:"varint,3,opt,name=type,proto3,enum=hashicorp.consul.mesh.v1alpha1.LogSinkType" json:"type,omitempty"`
+	// path is the output file to write logs
+	Path string `protobuf:"bytes,4,opt,name=path,proto3" json:"path,omitempty"`
+	// The presence of one format string or the other implies the access log string encoding.
+	// Defining both is invalid.
+	//
+	// Types that are assignable to Format:
+	//
+	//	*AccessLogs_Json
+	//	*AccessLogs_Text
+	Format isAccessLogs_Format `protobuf_oneof:"format"`
+}
+
+func (x *AccessLogs) Reset() {
+	*x = AccessLogs{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_access_logs_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessLogs) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessLogs) ProtoMessage() {}
+
+func (x *AccessLogs) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_access_logs_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessLogs.ProtoReflect.Descriptor instead.
+func (*AccessLogs) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_access_logs_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AccessLogs) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *AccessLogs) GetDisableListenerLogs() bool {
+	if x != nil {
+		return x.DisableListenerLogs
+	}
+	return false
+}
+
+func (x *AccessLogs) GetType() LogSinkType {
+	if x != nil {
+		return x.Type
+	}
+	return LogSinkType_LOG_SINK_TYPE_DEFAULT
+}
+
+func (x *AccessLogs) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (m *AccessLogs) GetFormat() isAccessLogs_Format {
+	if m != nil {
+		return m.Format
+	}
+	return nil
+}
+
+func (x *AccessLogs) GetJson() string {
+	if x, ok := x.GetFormat().(*AccessLogs_Json); ok {
+		return x.Json
+	}
+	return ""
+}
+
+func (x *AccessLogs) GetText() string {
+	if x, ok := x.GetFormat().(*AccessLogs_Text); ok {
+		return x.Text
+	}
+	return ""
+}
+
+type isAccessLogs_Format interface {
+	isAccessLogs_Format()
+}
+
+type AccessLogs_Json struct {
+	Json string `protobuf:"bytes,5,opt,name=json,proto3,oneof"`
+}
+
+type AccessLogs_Text struct {
+	Text string `protobuf:"bytes,6,opt,name=text,proto3,oneof"`
+}
+
+func (*AccessLogs_Json) isAccessLogs_Format() {}
+
+func (*AccessLogs_Text) isAccessLogs_Format() {}
+
+var File_pbmesh_v1alpha1_access_logs_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_access_logs_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x22, 0xe5, 0x01, 0x0a, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x32, 0x0a, 0x15,
+	0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
+	0x5f, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x64, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x73,
+	0x12, 0x3f, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x4c, 0x6f, 0x67, 0x53, 0x69, 0x6e, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x14, 0x0a, 0x04, 0x6a, 0x73, 0x6f, 0x6e, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x6a, 0x73, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x04, 0x74,
+	0x65, 0x78, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x74, 0x65, 0x78,
+	0x74, 0x42, 0x08, 0x0a, 0x06, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x2a, 0x74, 0x0a, 0x0b, 0x4c,
+	0x6f, 0x67, 0x53, 0x69, 0x6e, 0x6b, 0x54, 0x79, 0x70, 0x65, 0x12, 0x19, 0x0a, 0x15, 0x4c, 0x4f,
+	0x47, 0x5f, 0x53, 0x49, 0x4e, 0x4b, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41,
+	0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x4c, 0x4f, 0x47, 0x5f, 0x53, 0x49, 0x4e,
+	0x4b, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x10, 0x01, 0x12, 0x18, 0x0a,
+	0x14, 0x4c, 0x4f, 0x47, 0x5f, 0x53, 0x49, 0x4e, 0x4b, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53,
+	0x54, 0x44, 0x45, 0x52, 0x52, 0x10, 0x02, 0x12, 0x18, 0x0a, 0x14, 0x4c, 0x4f, 0x47, 0x5f, 0x53,
+	0x49, 0x4e, 0x4b, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x54, 0x44, 0x4f, 0x55, 0x54, 0x10,
+	0x03, 0x42, 0x97, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0f, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x6f, 0x67, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68,
+	0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73,
+	0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65,
+	0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73,
+	0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_access_logs_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_access_logs_proto_rawDescData = file_pbmesh_v1alpha1_access_logs_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_access_logs_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_access_logs_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_access_logs_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_access_logs_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_access_logs_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_access_logs_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbmesh_v1alpha1_access_logs_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_pbmesh_v1alpha1_access_logs_proto_goTypes = []interface{}{
+	(LogSinkType)(0),   // 0: hashicorp.consul.mesh.v1alpha1.LogSinkType
+	(*AccessLogs)(nil), // 1: hashicorp.consul.mesh.v1alpha1.AccessLogs
+}
+var file_pbmesh_v1alpha1_access_logs_proto_depIdxs = []int32{
+	0, // 0: hashicorp.consul.mesh.v1alpha1.AccessLogs.type:type_name -> hashicorp.consul.mesh.v1alpha1.LogSinkType
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_access_logs_proto_init() }
+func file_pbmesh_v1alpha1_access_logs_proto_init() {
+	if File_pbmesh_v1alpha1_access_logs_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_access_logs_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessLogs); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_pbmesh_v1alpha1_access_logs_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*AccessLogs_Json)(nil),
+		(*AccessLogs_Text)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_access_logs_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_access_logs_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_access_logs_proto_depIdxs,
+		EnumInfos:         file_pbmesh_v1alpha1_access_logs_proto_enumTypes,
+		MessageInfos:      file_pbmesh_v1alpha1_access_logs_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_access_logs_proto = out.File
+	file_pbmesh_v1alpha1_access_logs_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_access_logs_proto_goTypes = nil
+	file_pbmesh_v1alpha1_access_logs_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/access_logs.proto

@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+message AccessLogs {
+  // enabled enables access logging.
+  bool enabled = 1;
+  // disable_listener_logs turns off just listener logs for connections rejected by Envoy because they don't
+  // have a matching listener filter.
+  bool disable_listener_logs = 2;
+  // type selects the output for logs: "file", "stderr". "stdout"
+  LogSinkType type = 3;
+  // path is the output file to write logs
+  string path = 4;
+  // The presence of one format string or the other implies the access log string encoding.
+  // Defining both is invalid.
+  oneof format {
+    string json = 5;
+    string text = 6;
+  }
+}
+
+enum LogSinkType {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  LOG_SINK_TYPE_DEFAULT = 0;
+  LOG_SINK_TYPE_FILE = 1;
+  LOG_SINK_TYPE_STDERR = 2;
+  LOG_SINK_TYPE_STDOUT = 3;
+}

proto-public/pbmesh/v1alpha1/address.pb.binary.go

@@ -0,0 +1,18 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/address.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HostPortAddress) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HostPortAddress) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/address.pb.go

@@ -0,0 +1,173 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/address.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type HostPortAddress struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *HostPortAddress) Reset() {
+	*x = HostPortAddress{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_address_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HostPortAddress) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HostPortAddress) ProtoMessage() {}
+
+func (x *HostPortAddress) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_address_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HostPortAddress.ProtoReflect.Descriptor instead.
+func (*HostPortAddress) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_address_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *HostPortAddress) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *HostPortAddress) GetPort() uint32 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+var File_pbmesh_v1alpha1_address_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_address_proto_rawDesc = []byte{
+	0x0a, 0x1d, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x22,
+	0x39, 0x0a, 0x0f, 0x48, 0x6f, 0x73, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x94, 0x02, 0x0a, 0x22, 0x63,
+	0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x42, 0x0c, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65,
+	0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02,
+	0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca,
+	0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_address_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_address_proto_rawDescData = file_pbmesh_v1alpha1_address_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_address_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_address_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_address_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_address_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_address_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_address_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_pbmesh_v1alpha1_address_proto_goTypes = []interface{}{
+	(*HostPortAddress)(nil), // 0: hashicorp.consul.mesh.v1alpha1.HostPortAddress
+}
+var file_pbmesh_v1alpha1_address_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_address_proto_init() }
+func file_pbmesh_v1alpha1_address_proto_init() {
+	if File_pbmesh_v1alpha1_address_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_address_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HostPortAddress); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_address_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_address_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_address_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_address_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_address_proto = out.File
+	file_pbmesh_v1alpha1_address_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_address_proto_goTypes = nil
+	file_pbmesh_v1alpha1_address_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/address.proto

@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+message HostPortAddress {
+  string host = 1;
+  uint32 port = 2;
+}

proto-public/pbmesh/v1alpha1/cluster.pb.binary.go

@@ -0,0 +1,248 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/cluster.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Cluster) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Cluster) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *FailoverGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *FailoverGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *FailoverGroupConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *FailoverGroupConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *EndpointGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *EndpointGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DynamicEndpointGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DynamicEndpointGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *PassthroughEndpointGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *PassthroughEndpointGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DNSEndpointGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DNSEndpointGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *StaticEndpointGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *StaticEndpointGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L4WeightedClusterGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L4WeightedClusterGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L7WeightedClusterGroup) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L7WeightedClusterGroup) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L4WeightedDestinationCluster) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L4WeightedDestinationCluster) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L7WeightedDestinationCluster) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L7WeightedDestinationCluster) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DynamicEndpointGroupConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DynamicEndpointGroupConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LBPolicyLeastRequest) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LBPolicyLeastRequest) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LBPolicyRoundRobin) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LBPolicyRoundRobin) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LBPolicyRandom) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LBPolicyRandom) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LBPolicyRingHash) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LBPolicyRingHash) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LBPolicyMaglev) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LBPolicyMaglev) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *CircuitBreakers) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *CircuitBreakers) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *OutlierDetection) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *OutlierDetection) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *UpstreamConnectionOptions) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *UpstreamConnectionOptions) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *PassthroughEndpointGroupConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *PassthroughEndpointGroupConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DNSEndpointGroupConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DNSEndpointGroupConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *StaticEndpointGroupConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *StaticEndpointGroupConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/cluster.proto

@@ -0,0 +1,179 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
+import "pbmesh/v1alpha1/header_mutations.proto";
+import "pbmesh/v1alpha1/transport_socket.proto";
+import "pbmesh/v1alpha1/upstreams_configuration.proto";
+
+message Cluster {
+  // group is either a failover group or endpoint group. If this cluster needs to failover to other clusters, use the failover group. If this cluster routes directly to endpoints, use the endpoint group.
+  oneof group {
+    FailoverGroup failover_group = 1;
+    EndpointGroup endpoint_group = 2;
+  }
+  // escape_hatch_cluster_json configures a user configured escape hatch cluster.
+  string escape_hatch_cluster_json = 3;
+}
+
+message FailoverGroup {
+  // name of the failover group.
+  string name = 1;
+  // endpoint_groups is an ordered list of which groups to failover to.
+  repeated EndpointGroup endpoint_groups = 2;
+  FailoverGroupConfig config = 3;
+}
+
+message FailoverGroupConfig {
+  bool use_alt_stat_name = 1;
+  google.protobuf.Duration connect_timeout = 2;
+}
+
+message EndpointGroup {
+  oneof group {
+    // dynamic endpoint group is used to reach mesh destinations that are dynamically configured from Consul's catalog.
+    DynamicEndpointGroup dynamic = 1;
+    // static endpoint group is used to reach local app ports.
+    StaticEndpointGroup static = 2;
+    // dns is used to reach mesh and non-mesh destinations using a hostname.
+    DNSEndpointGroup dns = 3;
+    // passthrough is used to reach destinations that don't have endpoints saved in Consul.
+    PassthroughEndpointGroup passthrough = 4;
+  }
+}
+
+message DynamicEndpointGroup {
+  // name will be the name of the Envoy cluster created by this endpoint group.
+  string name = 1;
+  // config configures how to connect to the endpoints.
+  DynamicEndpointGroupConfig config = 2;
+  // outbound_tls will configure what TLS information to use when connecting to an upstream.
+  TransportSocket outbound_tls = 3;
+}
+
+message PassthroughEndpointGroup {
+  // name will be the name of the Envoy cluster created by this endpoint group.
+  string name = 1;
+  // config configures how to connect to the endpoints.
+  PassthroughEndpointGroupConfig config = 2;
+  // outbound_tls will configure what TLS information to use when connecting to an upstream.
+  TransportSocket outbound_tls = 3;
+}
+
+message DNSEndpointGroup {
+  // name will be the name of the Envoy cluster created by this endpoint group.
+  string name = 1;
+  // config configures how to connect to the endpoints.
+  DNSEndpointGroupConfig config = 2;
+  // outbound_tls will configure what TLS information to use when connecting to an upstream.
+  TransportSocket outbound_tls = 3;
+}
+
+// StaticEndpointGroup is used to reach local app ports.
+message StaticEndpointGroup {
+  // name will be the name of the Envoy cluster created by this endpoint group.
+  string name = 1;
+  // config configures how to connect to the endpoints.
+  StaticEndpointGroupConfig config = 2;
+}
+
+message L4WeightedClusterGroup {
+  // clusters to route to by weight.
+  repeated L4WeightedDestinationCluster clusters = 1;
+}
+
+message L7WeightedClusterGroup {
+  // clusters to route to by weight.
+  repeated L7WeightedDestinationCluster clusters = 1;
+}
+
+message L4WeightedDestinationCluster {
+  // name is the name of the cluster. This will be used to look up a cluster in the clusters map.
+  string name = 1;
+  google.protobuf.UInt32Value weight = 2;
+}
+
+message L7WeightedDestinationCluster {
+  // name is the name of the cluster. This will be used to look up a cluster in the clusters map.
+  string name = 1;
+  google.protobuf.UInt32Value weight = 2;
+  repeated HeaderMutation header_mutations = 3;
+}
+
+message DynamicEndpointGroupConfig {
+  google.protobuf.Duration connect_timeout = 1;
+  bool disable_panic_threshold = 2;
+  oneof lb_policy {
+    LBPolicyLeastRequest least_request = 3;
+    LBPolicyRoundRobin round_robin = 4;
+    LBPolicyRandom random = 5;
+    LBPolicyRingHash ring_hash = 6;
+    LBPolicyMaglev maglev = 7;
+  }
+  CircuitBreakers circuit_breakers = 8;
+  OutlierDetection outlier_detection = 9;
+  UpstreamConnectionOptions upstream_connection_options = 10;
+  bool use_alt_stat_name = 11;
+}
+
+message LBPolicyLeastRequest {
+  google.protobuf.UInt32Value choice_count = 1;
+}
+message LBPolicyRoundRobin {}
+
+message LBPolicyRandom {}
+
+message LBPolicyRingHash {
+  google.protobuf.UInt64Value minimum_ring_size = 1;
+  google.protobuf.UInt64Value maximum_ring_size = 2;
+}
+
+message LBPolicyMaglev {}
+
+message CircuitBreakers {
+  UpstreamLimits upstream_limits = 1;
+}
+
+message OutlierDetection {
+  google.protobuf.Duration interval = 1;
+  google.protobuf.UInt32Value consecutive_5xx = 2;
+  google.protobuf.UInt32Value enforcing_consecutive_5xx = 3;
+  google.protobuf.UInt32Value max_ejection_percent = 4;
+  google.protobuf.Duration base_ejection_time = 5;
+}
+
+message UpstreamConnectionOptions {
+  google.protobuf.UInt32Value tcp_keepalive_time = 1;
+  google.protobuf.UInt32Value tcp_keepalive_interval = 2;
+  google.protobuf.UInt32Value tcp_keepalive_probes = 3;
+}
+
+message PassthroughEndpointGroupConfig {
+  google.protobuf.Duration connect_timeout = 1;
+}
+
+message DNSEndpointGroupConfig {
+  google.protobuf.Duration connect_timeout = 1;
+  bool disable_panic_threshold = 2;
+  DiscoveryType discovery_type = 3;
+  CircuitBreakers circuit_breakers = 4;
+  OutlierDetection outlier_detection = 5;
+  UpstreamConnectionOptions upstream_connection_options = 6;
+  bool use_alt_stat_name = 7;
+}
+
+enum DiscoveryType {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  DISCOVERY_TYPE_LOGICAL = 0;
+  DISCOVERY_TYPE_STRICT = 1;
+}
+
+message StaticEndpointGroupConfig {
+  google.protobuf.Duration connect_timeout = 1;
+  CircuitBreakers circuit_breakers = 2;
+}

proto-public/pbmesh/v1alpha1/endpoints.pb.binary.go

@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/endpoints.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Endpoints) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Endpoints) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Endpoint) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Endpoint) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/endpoints.pb.go

@@ -0,0 +1,390 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/endpoints.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type HealthStatus int32
+
+const (
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	HealthStatus_HEALTH_STATUS_UNKNOWN   HealthStatus = 0
+	HealthStatus_HEALTH_STATUS_HEALTHY   HealthStatus = 1
+	HealthStatus_HEALTH_STATUS_UNHEALTHY HealthStatus = 2
+)
+
+// Enum value maps for HealthStatus.
+var (
+	HealthStatus_name = map[int32]string{
+		0: "HEALTH_STATUS_UNKNOWN",
+		1: "HEALTH_STATUS_HEALTHY",
+		2: "HEALTH_STATUS_UNHEALTHY",
+	}
+	HealthStatus_value = map[string]int32{
+		"HEALTH_STATUS_UNKNOWN":   0,
+		"HEALTH_STATUS_HEALTHY":   1,
+		"HEALTH_STATUS_UNHEALTHY": 2,
+	}
+)
+
+func (x HealthStatus) Enum() *HealthStatus {
+	p := new(HealthStatus)
+	*p = x
+	return p
+}
+
+func (x HealthStatus) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (HealthStatus) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbmesh_v1alpha1_endpoints_proto_enumTypes[0].Descriptor()
+}
+
+func (HealthStatus) Type() protoreflect.EnumType {
+	return &file_pbmesh_v1alpha1_endpoints_proto_enumTypes[0]
+}
+
+func (x HealthStatus) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use HealthStatus.Descriptor instead.
+func (HealthStatus) EnumDescriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_endpoints_proto_rawDescGZIP(), []int{0}
+}
+
+type Endpoints struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// name is the name of the Endpoints. This should match the cluster name.
+	Name      string      `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Endpoints []*Endpoint `protobuf:"bytes,2,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
+}
+
+func (x *Endpoints) Reset() {
+	*x = Endpoints{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_endpoints_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Endpoints) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Endpoints) ProtoMessage() {}
+
+func (x *Endpoints) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_endpoints_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Endpoints.ProtoReflect.Descriptor instead.
+func (*Endpoints) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_endpoints_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Endpoints) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Endpoints) GetEndpoints() []*Endpoint {
+	if x != nil {
+		return x.Endpoints
+	}
+	return nil
+}
+
+type Endpoint struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Address:
+	//
+	//	*Endpoint_HostPort
+	//	*Endpoint_UnixSocket
+	Address             isEndpoint_Address      `protobuf_oneof:"address"`
+	HealthStatus        HealthStatus            `protobuf:"varint,3,opt,name=health_status,json=healthStatus,proto3,enum=hashicorp.consul.mesh.v1alpha1.HealthStatus" json:"health_status,omitempty"`
+	LoadBalancingWeight *wrapperspb.UInt32Value `protobuf:"bytes,4,opt,name=load_balancing_weight,json=loadBalancingWeight,proto3" json:"load_balancing_weight,omitempty"`
+}
+
+func (x *Endpoint) Reset() {
+	*x = Endpoint{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_endpoints_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Endpoint) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Endpoint) ProtoMessage() {}
+
+func (x *Endpoint) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_endpoints_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Endpoint.ProtoReflect.Descriptor instead.
+func (*Endpoint) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_endpoints_proto_rawDescGZIP(), []int{1}
+}
+
+func (m *Endpoint) GetAddress() isEndpoint_Address {
+	if m != nil {
+		return m.Address
+	}
+	return nil
+}
+
+func (x *Endpoint) GetHostPort() *HostPortAddress {
+	if x, ok := x.GetAddress().(*Endpoint_HostPort); ok {
+		return x.HostPort
+	}
+	return nil
+}
+
+func (x *Endpoint) GetUnixSocket() *UnixSocketAddress {
+	if x, ok := x.GetAddress().(*Endpoint_UnixSocket); ok {
+		return x.UnixSocket
+	}
+	return nil
+}
+
+func (x *Endpoint) GetHealthStatus() HealthStatus {
+	if x != nil {
+		return x.HealthStatus
+	}
+	return HealthStatus_HEALTH_STATUS_UNKNOWN
+}
+
+func (x *Endpoint) GetLoadBalancingWeight() *wrapperspb.UInt32Value {
+	if x != nil {
+		return x.LoadBalancingWeight
+	}
+	return nil
+}
+
+type isEndpoint_Address interface {
+	isEndpoint_Address()
+}
+
+type Endpoint_HostPort struct {
+	HostPort *HostPortAddress `protobuf:"bytes,1,opt,name=host_port,json=hostPort,proto3,oneof"`
+}
+
+type Endpoint_UnixSocket struct {
+	UnixSocket *UnixSocketAddress `protobuf:"bytes,2,opt,name=unix_socket,json=unixSocket,proto3,oneof"`
+}
+
+func (*Endpoint_HostPort) isEndpoint_Address() {}
+
+func (*Endpoint_UnixSocket) isEndpoint_Address() {}
+
+var File_pbmesh_v1alpha1_endpoints_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_endpoints_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x1d, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x1f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0x67, 0x0a, 0x09, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x46, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52,
+	0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x22, 0xe0, 0x02, 0x0a, 0x08, 0x45,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x4e, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f,
+	0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65,
+	0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74,
+	0x50, 0x6f, 0x72, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x48, 0x00, 0x52, 0x08, 0x68,
+	0x6f, 0x73, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x54, 0x0a, 0x0b, 0x75, 0x6e, 0x69, 0x78, 0x5f,
+	0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x6e,
+	0x69, 0x78, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x48,
+	0x00, 0x52, 0x0a, 0x75, 0x6e, 0x69, 0x78, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x51, 0x0a,
+	0x0d, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x0c, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x50, 0x0a, 0x15, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x62, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x69,
+	0x6e, 0x67, 0x5f, 0x77, 0x65, 0x69, 0x67, 0x68, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x6c,
+	0x6f, 0x61, 0x64, 0x42, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x69, 0x6e, 0x67, 0x57, 0x65, 0x69, 0x67,
+	0x68, 0x74, 0x42, 0x09, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x2a, 0x61, 0x0a,
+	0x0c, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x19, 0x0a,
+	0x15, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55,
+	0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x19, 0x0a, 0x15, 0x48, 0x45, 0x41, 0x4c,
+	0x54, 0x48, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48,
+	0x59, 0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x5f, 0x53, 0x54,
+	0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x59, 0x10, 0x02,
+	0x42, 0x96, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68,
+	0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a,
+	0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_endpoints_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_endpoints_proto_rawDescData = file_pbmesh_v1alpha1_endpoints_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_endpoints_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_endpoints_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_endpoints_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_endpoints_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_endpoints_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_endpoints_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbmesh_v1alpha1_endpoints_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbmesh_v1alpha1_endpoints_proto_goTypes = []interface{}{
+	(HealthStatus)(0),              // 0: hashicorp.consul.mesh.v1alpha1.HealthStatus
+	(*Endpoints)(nil),              // 1: hashicorp.consul.mesh.v1alpha1.Endpoints
+	(*Endpoint)(nil),               // 2: hashicorp.consul.mesh.v1alpha1.Endpoint
+	(*HostPortAddress)(nil),        // 3: hashicorp.consul.mesh.v1alpha1.HostPortAddress
+	(*UnixSocketAddress)(nil),      // 4: hashicorp.consul.mesh.v1alpha1.UnixSocketAddress
+	(*wrapperspb.UInt32Value)(nil), // 5: google.protobuf.UInt32Value
+}
+var file_pbmesh_v1alpha1_endpoints_proto_depIdxs = []int32{
+	2, // 0: hashicorp.consul.mesh.v1alpha1.Endpoints.endpoints:type_name -> hashicorp.consul.mesh.v1alpha1.Endpoint
+	3, // 1: hashicorp.consul.mesh.v1alpha1.Endpoint.host_port:type_name -> hashicorp.consul.mesh.v1alpha1.HostPortAddress
+	4, // 2: hashicorp.consul.mesh.v1alpha1.Endpoint.unix_socket:type_name -> hashicorp.consul.mesh.v1alpha1.UnixSocketAddress
+	0, // 3: hashicorp.consul.mesh.v1alpha1.Endpoint.health_status:type_name -> hashicorp.consul.mesh.v1alpha1.HealthStatus
+	5, // 4: hashicorp.consul.mesh.v1alpha1.Endpoint.load_balancing_weight:type_name -> google.protobuf.UInt32Value
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_endpoints_proto_init() }
+func file_pbmesh_v1alpha1_endpoints_proto_init() {
+	if File_pbmesh_v1alpha1_endpoints_proto != nil {
+		return
+	}
+	file_pbmesh_v1alpha1_address_proto_init()
+	file_pbmesh_v1alpha1_upstreams_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_endpoints_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Endpoints); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_endpoints_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Endpoint); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_pbmesh_v1alpha1_endpoints_proto_msgTypes[1].OneofWrappers = []interface{}{
+		(*Endpoint_HostPort)(nil),
+		(*Endpoint_UnixSocket)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_endpoints_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_endpoints_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_endpoints_proto_depIdxs,
+		EnumInfos:         file_pbmesh_v1alpha1_endpoints_proto_enumTypes,
+		MessageInfos:      file_pbmesh_v1alpha1_endpoints_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_endpoints_proto = out.File
+	file_pbmesh_v1alpha1_endpoints_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_endpoints_proto_goTypes = nil
+	file_pbmesh_v1alpha1_endpoints_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/endpoints.proto

@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "google/protobuf/wrappers.proto";
+import "pbmesh/v1alpha1/address.proto";
+import "pbmesh/v1alpha1/upstreams.proto";
+
+message Endpoints {
+  // name is the name of the Endpoints. This should match the cluster name.
+  string name = 1;
+  repeated Endpoint endpoints = 2;
+}
+
+message Endpoint {
+  oneof address {
+    HostPortAddress host_port = 1;
+    UnixSocketAddress unix_socket = 2;
+  }
+  HealthStatus health_status = 3;
+  google.protobuf.UInt32Value load_balancing_weight = 4;
+}
+
+enum HealthStatus {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  HEALTH_STATUS_UNKNOWN = 0;
+  HEALTH_STATUS_HEALTHY = 1;
+  HEALTH_STATUS_UNHEALTHY = 2;
+}

proto-public/pbmesh/v1alpha1/escape_hatches.pb.binary.go

@@ -0,0 +1,18 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/escape_hatches.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *EscapeHatches) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *EscapeHatches) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/escape_hatches.pb.go

@@ -0,0 +1,167 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/escape_hatches.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type EscapeHatches struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// listener_tracing_json contains user provided tracing configuration.
+	ListenerTracingJson string `protobuf:"bytes,1,opt,name=listener_tracing_json,json=listenerTracingJson,proto3" json:"listener_tracing_json,omitempty"`
+}
+
+func (x *EscapeHatches) Reset() {
+	*x = EscapeHatches{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_escape_hatches_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EscapeHatches) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EscapeHatches) ProtoMessage() {}
+
+func (x *EscapeHatches) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_escape_hatches_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EscapeHatches.ProtoReflect.Descriptor instead.
+func (*EscapeHatches) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_escape_hatches_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *EscapeHatches) GetListenerTracingJson() string {
+	if x != nil {
+		return x.ListenerTracingJson
+	}
+	return ""
+}
+
+var File_pbmesh_v1alpha1_escape_hatches_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_escape_hatches_proto_rawDesc = []byte{
+	0x0a, 0x24, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x65, 0x73, 0x63, 0x61, 0x70, 0x65, 0x5f, 0x68, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x22, 0x43, 0x0a, 0x0d, 0x45, 0x73, 0x63, 0x61, 0x70, 0x65,
+	0x48, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x6c, 0x69, 0x73, 0x74, 0x65,
+	0x6e, 0x65, 0x72, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x5f, 0x6a, 0x73, 0x6f, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
+	0x54, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x4a, 0x73, 0x6f, 0x6e, 0x42, 0x9a, 0x02, 0x0a, 0x22,
+	0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x42, 0x12, 0x45, 0x73, 0x63, 0x61, 0x70, 0x65, 0x48, 0x61, 0x74, 0x63, 0x68, 0x65,
+	0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2,
+	0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_escape_hatches_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_escape_hatches_proto_rawDescData = file_pbmesh_v1alpha1_escape_hatches_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_escape_hatches_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_escape_hatches_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_escape_hatches_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_escape_hatches_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_escape_hatches_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_escape_hatches_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_pbmesh_v1alpha1_escape_hatches_proto_goTypes = []interface{}{
+	(*EscapeHatches)(nil), // 0: hashicorp.consul.mesh.v1alpha1.EscapeHatches
+}
+var file_pbmesh_v1alpha1_escape_hatches_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_escape_hatches_proto_init() }
+func file_pbmesh_v1alpha1_escape_hatches_proto_init() {
+	if File_pbmesh_v1alpha1_escape_hatches_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_escape_hatches_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EscapeHatches); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_escape_hatches_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_escape_hatches_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_escape_hatches_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_escape_hatches_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_escape_hatches_proto = out.File
+	file_pbmesh_v1alpha1_escape_hatches_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_escape_hatches_proto_goTypes = nil
+	file_pbmesh_v1alpha1_escape_hatches_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/escape_hatches.proto

@@ -0,0 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+message EscapeHatches {
+  // listener_tracing_json contains user provided tracing configuration.
+  string listener_tracing_json = 1;
+}

proto-public/pbmesh/v1alpha1/header_mutations.pb.binary.go

@@ -0,0 +1,68 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/header_mutations.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HeaderMutation) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HeaderMutation) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *RequestHeaderAdd) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *RequestHeaderAdd) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *RequestHeaderRemove) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *RequestHeaderRemove) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ResponseHeaderAdd) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ResponseHeaderAdd) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ResponseHeaderRemove) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ResponseHeaderRemove) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Header) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Header) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/header_mutations.pb.go

@@ -0,0 +1,681 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/header_mutations.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type AppendAction int32
+
+const (
+	// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+	AppendAction_APPEND_ACTION_APPEND_IF_EXISTS_OR_ADD    AppendAction = 0
+	AppendAction_APPEND_ACTION_OVERWRITE_IF_EXISTS_OR_ADD AppendAction = 1
+)
+
+// Enum value maps for AppendAction.
+var (
+	AppendAction_name = map[int32]string{
+		0: "APPEND_ACTION_APPEND_IF_EXISTS_OR_ADD",
+		1: "APPEND_ACTION_OVERWRITE_IF_EXISTS_OR_ADD",
+	}
+	AppendAction_value = map[string]int32{
+		"APPEND_ACTION_APPEND_IF_EXISTS_OR_ADD":    0,
+		"APPEND_ACTION_OVERWRITE_IF_EXISTS_OR_ADD": 1,
+	}
+)
+
+func (x AppendAction) Enum() *AppendAction {
+	p := new(AppendAction)
+	*p = x
+	return p
+}
+
+func (x AppendAction) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AppendAction) Descriptor() protoreflect.EnumDescriptor {
+	return file_pbmesh_v1alpha1_header_mutations_proto_enumTypes[0].Descriptor()
+}
+
+func (AppendAction) Type() protoreflect.EnumType {
+	return &file_pbmesh_v1alpha1_header_mutations_proto_enumTypes[0]
+}
+
+func (x AppendAction) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AppendAction.Descriptor instead.
+func (AppendAction) EnumDescriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{0}
+}
+
+// Note: it's nice to have this list of header mutations as opposed to configuration similar to Envoy because it
+// translates more nicely from GAMMA HTTPRoute, and our existing service router config. Then xds code can handle turning
+// it into envoy xds.
+type HeaderMutation struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Action:
+	//
+	//	*HeaderMutation_RequestHeaderAdd
+	//	*HeaderMutation_RequestHeaderRemove
+	//	*HeaderMutation_ResponseHeaderAdd
+	//	*HeaderMutation_ResponseHeaderRemove
+	Action isHeaderMutation_Action `protobuf_oneof:"action"`
+}
+
+func (x *HeaderMutation) Reset() {
+	*x = HeaderMutation{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HeaderMutation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HeaderMutation) ProtoMessage() {}
+
+func (x *HeaderMutation) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HeaderMutation.ProtoReflect.Descriptor instead.
+func (*HeaderMutation) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{0}
+}
+
+func (m *HeaderMutation) GetAction() isHeaderMutation_Action {
+	if m != nil {
+		return m.Action
+	}
+	return nil
+}
+
+func (x *HeaderMutation) GetRequestHeaderAdd() *RequestHeaderAdd {
+	if x, ok := x.GetAction().(*HeaderMutation_RequestHeaderAdd); ok {
+		return x.RequestHeaderAdd
+	}
+	return nil
+}
+
+func (x *HeaderMutation) GetRequestHeaderRemove() *RequestHeaderRemove {
+	if x, ok := x.GetAction().(*HeaderMutation_RequestHeaderRemove); ok {
+		return x.RequestHeaderRemove
+	}
+	return nil
+}
+
+func (x *HeaderMutation) GetResponseHeaderAdd() *ResponseHeaderAdd {
+	if x, ok := x.GetAction().(*HeaderMutation_ResponseHeaderAdd); ok {
+		return x.ResponseHeaderAdd
+	}
+	return nil
+}
+
+func (x *HeaderMutation) GetResponseHeaderRemove() *ResponseHeaderRemove {
+	if x, ok := x.GetAction().(*HeaderMutation_ResponseHeaderRemove); ok {
+		return x.ResponseHeaderRemove
+	}
+	return nil
+}
+
+type isHeaderMutation_Action interface {
+	isHeaderMutation_Action()
+}
+
+type HeaderMutation_RequestHeaderAdd struct {
+	RequestHeaderAdd *RequestHeaderAdd `protobuf:"bytes,1,opt,name=request_header_add,json=requestHeaderAdd,proto3,oneof"`
+}
+
+type HeaderMutation_RequestHeaderRemove struct {
+	RequestHeaderRemove *RequestHeaderRemove `protobuf:"bytes,2,opt,name=request_header_remove,json=requestHeaderRemove,proto3,oneof"`
+}
+
+type HeaderMutation_ResponseHeaderAdd struct {
+	ResponseHeaderAdd *ResponseHeaderAdd `protobuf:"bytes,3,opt,name=response_header_add,json=responseHeaderAdd,proto3,oneof"`
+}
+
+type HeaderMutation_ResponseHeaderRemove struct {
+	ResponseHeaderRemove *ResponseHeaderRemove `protobuf:"bytes,4,opt,name=response_header_remove,json=responseHeaderRemove,proto3,oneof"`
+}
+
+func (*HeaderMutation_RequestHeaderAdd) isHeaderMutation_Action() {}
+
+func (*HeaderMutation_RequestHeaderRemove) isHeaderMutation_Action() {}
+
+func (*HeaderMutation_ResponseHeaderAdd) isHeaderMutation_Action() {}
+
+func (*HeaderMutation_ResponseHeaderRemove) isHeaderMutation_Action() {}
+
+type RequestHeaderAdd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Header       *Header      `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
+	AppendAction AppendAction `protobuf:"varint,2,opt,name=append_action,json=appendAction,proto3,enum=hashicorp.consul.mesh.v1alpha1.AppendAction" json:"append_action,omitempty"`
+}
+
+func (x *RequestHeaderAdd) Reset() {
+	*x = RequestHeaderAdd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestHeaderAdd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestHeaderAdd) ProtoMessage() {}
+
+func (x *RequestHeaderAdd) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestHeaderAdd.ProtoReflect.Descriptor instead.
+func (*RequestHeaderAdd) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RequestHeaderAdd) GetHeader() *Header {
+	if x != nil {
+		return x.Header
+	}
+	return nil
+}
+
+func (x *RequestHeaderAdd) GetAppendAction() AppendAction {
+	if x != nil {
+		return x.AppendAction
+	}
+	return AppendAction_APPEND_ACTION_APPEND_IF_EXISTS_OR_ADD
+}
+
+type RequestHeaderRemove struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	HeaderKeys []string `protobuf:"bytes,1,rep,name=header_keys,json=headerKeys,proto3" json:"header_keys,omitempty"`
+}
+
+func (x *RequestHeaderRemove) Reset() {
+	*x = RequestHeaderRemove{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestHeaderRemove) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestHeaderRemove) ProtoMessage() {}
+
+func (x *RequestHeaderRemove) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestHeaderRemove.ProtoReflect.Descriptor instead.
+func (*RequestHeaderRemove) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *RequestHeaderRemove) GetHeaderKeys() []string {
+	if x != nil {
+		return x.HeaderKeys
+	}
+	return nil
+}
+
+type ResponseHeaderAdd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Header       *Header      `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
+	AppendAction AppendAction `protobuf:"varint,2,opt,name=append_action,json=appendAction,proto3,enum=hashicorp.consul.mesh.v1alpha1.AppendAction" json:"append_action,omitempty"`
+}
+
+func (x *ResponseHeaderAdd) Reset() {
+	*x = ResponseHeaderAdd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResponseHeaderAdd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResponseHeaderAdd) ProtoMessage() {}
+
+func (x *ResponseHeaderAdd) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResponseHeaderAdd.ProtoReflect.Descriptor instead.
+func (*ResponseHeaderAdd) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ResponseHeaderAdd) GetHeader() *Header {
+	if x != nil {
+		return x.Header
+	}
+	return nil
+}
+
+func (x *ResponseHeaderAdd) GetAppendAction() AppendAction {
+	if x != nil {
+		return x.AppendAction
+	}
+	return AppendAction_APPEND_ACTION_APPEND_IF_EXISTS_OR_ADD
+}
+
+type ResponseHeaderRemove struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	HeaderKeys []string `protobuf:"bytes,1,rep,name=header_keys,json=headerKeys,proto3" json:"header_keys,omitempty"`
+}
+
+func (x *ResponseHeaderRemove) Reset() {
+	*x = ResponseHeaderRemove{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResponseHeaderRemove) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResponseHeaderRemove) ProtoMessage() {}
+
+func (x *ResponseHeaderRemove) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResponseHeaderRemove.ProtoReflect.Descriptor instead.
+func (*ResponseHeaderRemove) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ResponseHeaderRemove) GetHeaderKeys() []string {
+	if x != nil {
+		return x.HeaderKeys
+	}
+	return nil
+}
+
+type Header struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *Header) Reset() {
+	*x = Header{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Header) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Header) ProtoMessage() {}
+
+func (x *Header) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Header.ProtoReflect.Descriptor instead.
+func (*Header) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *Header) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *Header) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+var File_pbmesh_v1alpha1_header_mutations_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_header_mutations_proto_rawDesc = []byte{
+	0x0a, 0x26, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x22, 0xba, 0x03, 0x0a, 0x0e, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x4d, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x60, 0x0a, 0x12, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x64,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x64, 0x64, 0x48, 0x00, 0x52, 0x10, 0x72, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x64, 0x64, 0x12, 0x69, 0x0a,
+	0x15, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f,
+	0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x52, 0x65, 0x6d, 0x6f, 0x76,
+	0x65, 0x48, 0x00, 0x52, 0x13, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x12, 0x63, 0x0a, 0x13, 0x72, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x64, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x64, 0x64, 0x48, 0x00, 0x52, 0x11, 0x72, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x64, 0x64, 0x12, 0x6c, 0x0a,
+	0x16, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x5f, 0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x52, 0x65, 0x6d,
+	0x6f, 0x76, 0x65, 0x48, 0x00, 0x52, 0x14, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x42, 0x08, 0x0a, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xa5, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x64, 0x64, 0x12, 0x3e, 0x0a, 0x06, 0x68, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65,
+	0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x52, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x51, 0x0a, 0x0d, 0x61, 0x70,
+	0x70, 0x65, 0x6e, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x2c, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x41, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x0c, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x36, 0x0a,
+	0x13, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x52, 0x65,
+	0x6d, 0x6f, 0x76, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6b,
+	0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x4b, 0x65, 0x79, 0x73, 0x22, 0xa6, 0x01, 0x0a, 0x11, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x64, 0x64, 0x12, 0x3e, 0x0a, 0x06, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d,
+	0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x52, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x51, 0x0a, 0x0d, 0x61,
+	0x70, 0x70, 0x65, 0x6e, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x41, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x0c, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x37,
+	0x0a, 0x14, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x73, 0x22, 0x30, 0x0a, 0x06, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2a, 0x67, 0x0a, 0x0c, 0x41, 0x70, 0x70,
+	0x65, 0x6e, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x25, 0x41, 0x50, 0x50,
+	0x45, 0x4e, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x41, 0x50, 0x50, 0x45, 0x4e,
+	0x44, 0x5f, 0x49, 0x46, 0x5f, 0x45, 0x58, 0x49, 0x53, 0x54, 0x53, 0x5f, 0x4f, 0x52, 0x5f, 0x41,
+	0x44, 0x44, 0x10, 0x00, 0x12, 0x2c, 0x0a, 0x28, 0x41, 0x50, 0x50, 0x45, 0x4e, 0x44, 0x5f, 0x41,
+	0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x4f, 0x56, 0x45, 0x52, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f,
+	0x49, 0x46, 0x5f, 0x45, 0x58, 0x49, 0x53, 0x54, 0x53, 0x5f, 0x4f, 0x52, 0x5f, 0x41, 0x44, 0x44,
+	0x10, 0x01, 0x42, 0x9c, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x14, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x4d, 0x75, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65,
+	0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02,
+	0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca,
+	0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21,
+	0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_header_mutations_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_header_mutations_proto_rawDescData = file_pbmesh_v1alpha1_header_mutations_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_header_mutations_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_header_mutations_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_header_mutations_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_header_mutations_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_header_mutations_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_header_mutations_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_pbmesh_v1alpha1_header_mutations_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_pbmesh_v1alpha1_header_mutations_proto_goTypes = []interface{}{
+	(AppendAction)(0),            // 0: hashicorp.consul.mesh.v1alpha1.AppendAction
+	(*HeaderMutation)(nil),       // 1: hashicorp.consul.mesh.v1alpha1.HeaderMutation
+	(*RequestHeaderAdd)(nil),     // 2: hashicorp.consul.mesh.v1alpha1.RequestHeaderAdd
+	(*RequestHeaderRemove)(nil),  // 3: hashicorp.consul.mesh.v1alpha1.RequestHeaderRemove
+	(*ResponseHeaderAdd)(nil),    // 4: hashicorp.consul.mesh.v1alpha1.ResponseHeaderAdd
+	(*ResponseHeaderRemove)(nil), // 5: hashicorp.consul.mesh.v1alpha1.ResponseHeaderRemove
+	(*Header)(nil),               // 6: hashicorp.consul.mesh.v1alpha1.Header
+}
+var file_pbmesh_v1alpha1_header_mutations_proto_depIdxs = []int32{
+	2, // 0: hashicorp.consul.mesh.v1alpha1.HeaderMutation.request_header_add:type_name -> hashicorp.consul.mesh.v1alpha1.RequestHeaderAdd
+	3, // 1: hashicorp.consul.mesh.v1alpha1.HeaderMutation.request_header_remove:type_name -> hashicorp.consul.mesh.v1alpha1.RequestHeaderRemove
+	4, // 2: hashicorp.consul.mesh.v1alpha1.HeaderMutation.response_header_add:type_name -> hashicorp.consul.mesh.v1alpha1.ResponseHeaderAdd
+	5, // 3: hashicorp.consul.mesh.v1alpha1.HeaderMutation.response_header_remove:type_name -> hashicorp.consul.mesh.v1alpha1.ResponseHeaderRemove
+	6, // 4: hashicorp.consul.mesh.v1alpha1.RequestHeaderAdd.header:type_name -> hashicorp.consul.mesh.v1alpha1.Header
+	0, // 5: hashicorp.consul.mesh.v1alpha1.RequestHeaderAdd.append_action:type_name -> hashicorp.consul.mesh.v1alpha1.AppendAction
+	6, // 6: hashicorp.consul.mesh.v1alpha1.ResponseHeaderAdd.header:type_name -> hashicorp.consul.mesh.v1alpha1.Header
+	0, // 7: hashicorp.consul.mesh.v1alpha1.ResponseHeaderAdd.append_action:type_name -> hashicorp.consul.mesh.v1alpha1.AppendAction
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_header_mutations_proto_init() }
+func file_pbmesh_v1alpha1_header_mutations_proto_init() {
+	if File_pbmesh_v1alpha1_header_mutations_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HeaderMutation); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestHeaderAdd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestHeaderRemove); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResponseHeaderAdd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResponseHeaderRemove); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Header); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_pbmesh_v1alpha1_header_mutations_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*HeaderMutation_RequestHeaderAdd)(nil),
+		(*HeaderMutation_RequestHeaderRemove)(nil),
+		(*HeaderMutation_ResponseHeaderAdd)(nil),
+		(*HeaderMutation_ResponseHeaderRemove)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_header_mutations_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_header_mutations_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_header_mutations_proto_depIdxs,
+		EnumInfos:         file_pbmesh_v1alpha1_header_mutations_proto_enumTypes,
+		MessageInfos:      file_pbmesh_v1alpha1_header_mutations_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_header_mutations_proto = out.File
+	file_pbmesh_v1alpha1_header_mutations_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_header_mutations_proto_goTypes = nil
+	file_pbmesh_v1alpha1_header_mutations_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/header_mutations.proto

@@ -0,0 +1,47 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+// Note: it's nice to have this list of header mutations as opposed to configuration similar to Envoy because it
+// translates more nicely from GAMMA HTTPRoute, and our existing service router config. Then xds code can handle turning
+// it into envoy xds.
+message HeaderMutation {
+  oneof action {
+    RequestHeaderAdd request_header_add = 1;
+    RequestHeaderRemove request_header_remove = 2;
+    ResponseHeaderAdd response_header_add = 3;
+    ResponseHeaderRemove response_header_remove = 4;
+  }
+}
+
+message RequestHeaderAdd {
+  Header header = 1;
+  AppendAction append_action = 2;
+}
+
+message RequestHeaderRemove {
+  repeated string header_keys = 1;
+}
+
+message ResponseHeaderAdd {
+  Header header = 1;
+  AppendAction append_action = 2;
+}
+
+message ResponseHeaderRemove {
+  repeated string header_keys = 1;
+}
+
+message Header {
+  string key = 1;
+  string value = 2;
+}
+
+enum AppendAction {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  APPEND_ACTION_APPEND_IF_EXISTS_OR_ADD = 0;
+  APPEND_ACTION_OVERWRITE_IF_EXISTS_OR_ADD = 1;
+}

proto-public/pbmesh/v1alpha1/intentions.pb.binary.go

@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/intentions.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L7Intention) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L7Intention) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L4Intention) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L4Intention) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/intentions.pb.go

@@ -0,0 +1,206 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/intentions.proto
+
+package meshv1alpha1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type L7Intention struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *L7Intention) Reset() {
+	*x = L7Intention{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_intentions_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *L7Intention) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*L7Intention) ProtoMessage() {}
+
+func (x *L7Intention) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_intentions_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use L7Intention.ProtoReflect.Descriptor instead.
+func (*L7Intention) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_intentions_proto_rawDescGZIP(), []int{0}
+}
+
+type L4Intention struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *L4Intention) Reset() {
+	*x = L4Intention{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_intentions_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *L4Intention) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*L4Intention) ProtoMessage() {}
+
+func (x *L4Intention) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_intentions_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use L4Intention.ProtoReflect.Descriptor instead.
+func (*L4Intention) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_intentions_proto_rawDescGZIP(), []int{1}
+}
+
+var File_pbmesh_v1alpha1_intentions_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_intentions_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x22, 0x0d, 0x0a, 0x0b, 0x4c, 0x37, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0x0d, 0x0a, 0x0b, 0x4c, 0x34, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e,
+	0x42, 0x97, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0f, 0x49, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68,
+	0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73,
+	0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68,
+	0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_intentions_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_intentions_proto_rawDescData = file_pbmesh_v1alpha1_intentions_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_intentions_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_intentions_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_intentions_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_intentions_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_intentions_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_intentions_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_pbmesh_v1alpha1_intentions_proto_goTypes = []interface{}{
+	(*L7Intention)(nil), // 0: hashicorp.consul.mesh.v1alpha1.L7Intention
+	(*L4Intention)(nil), // 1: hashicorp.consul.mesh.v1alpha1.L4Intention
+}
+var file_pbmesh_v1alpha1_intentions_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_intentions_proto_init() }
+func file_pbmesh_v1alpha1_intentions_proto_init() {
+	if File_pbmesh_v1alpha1_intentions_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_intentions_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*L7Intention); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_intentions_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*L4Intention); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_intentions_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_intentions_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_intentions_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_intentions_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_intentions_proto = out.File
+	file_pbmesh_v1alpha1_intentions_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_intentions_proto_goTypes = nil
+	file_pbmesh_v1alpha1_intentions_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/intentions.proto

@@ -0,0 +1,10 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+message L7Intention {}
+
+message L4Intention {}

proto-public/pbmesh/v1alpha1/listener.pb.binary.go

@@ -0,0 +1,78 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/listener.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Listener) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Listener) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Router) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Router) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Match) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Match) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *CidrRange) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *CidrRange) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L4Destination) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L4Destination) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *L7Destination) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *L7Destination) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *SNIDestination) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *SNIDestination) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/listener.proto

@@ -0,0 +1,123 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "google/protobuf/wrappers.proto";
+import "pbmesh/v1alpha1/connection.proto";
+import "pbmesh/v1alpha1/intentions.proto";
+import "pbmesh/v1alpha1/transport_socket.proto";
+import "pbmesh/v1alpha1/upstreams.proto";
+
+message Listener {
+  // name is the name of the listener.
+  string name = 1;
+  // direction tells the listener the direction of traffic.
+  Direction direction = 2;
+  // bind_address describes where to listen.
+  oneof bind_address {
+    IPPortAddress ip_port = 3;
+    UnixSocketAddress unix_socket = 4;
+  }
+
+  // routers describes how to route traffic from this listener.
+  repeated Router routers = 5;
+  // default_router describes where to route if none of the other router matches match the connection.
+  Router default_router = 6;
+  // capabilities describe Envoy proxy functionality to enable. These map closely to Envoy listener filters.
+  repeated Capability capabilities = 7;
+  // balance_connections configures how the listener should balance connections.
+  BalanceConnections balance_connections = 8;
+  // escape_hatch_listener_json configures a user configured escape hatch listener.
+  string escape_hatch_listener = 9;
+  // use_escape_hatch_tracing configures whether to use the top level user configured tracing escape hatch for this listener.
+  bool use_escape_hatch_tracing = 10;
+}
+
+enum Direction {
+  // DIRECTION_UNSPECIFIED is used by mesh gateway listeners.
+  DIRECTION_UNSPECIFIED = 0;
+  DIRECTION_INBOUND = 1;
+  DIRECTION_OUTBOUND = 2;
+}
+
+// Capabilities map to proxy functionality to enable. These enable tproxy, l7 protocol/alpn inspection, or l4 sni/alpn inspection.
+enum Capability {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  CAPABILITY_TRANSPARENT = 0;
+  CAPABILITY_L7_PROTOCOL_INSPECTION = 1;
+  CAPABILITY_L4_TLS_INSPECTION = 2;
+}
+
+message Router {
+  // match specifies how to match traffic coming into this listener. If the traffic matches, it will be routed to the
+  // destination.
+  Match match = 1;
+  oneof destination {
+    // l4 is an l4 destination to route to, which will have a reference to a cluster.
+    L4Destination l4 = 2;
+    // l7 is an l7 destination to route to, which will have a reference to a route.
+    L7Destination l7 = 3;
+    // sni is an SNI destination, which means there will be no references, but the SNI name will be tied to the cluster
+    // name, so we should generate all clusters.
+    SNIDestination sni = 4;
+  }
+  // inbound_tls is used by inbound listeners that terminate TLS.
+  TransportSocket inbound_tls = 5;
+}
+
+message Match {
+  google.protobuf.UInt32Value destination_port = 1;
+  repeated CidrRange prefix_ranges = 2;
+  repeated CidrRange source_prefix_ranges = 3;
+  // server_names matches based on SNI of the incoming request.
+  repeated string server_names = 4;
+}
+
+message CidrRange {
+  string address_prefix = 1;
+  google.protobuf.UInt32Value prefix_len = 2;
+}
+
+message L4Destination {
+  // name is a key in the top level clusters map. This specifies which cluster to go to in this L4 destination.
+  string name = 1;
+  // stat_prefix is for compatibility with v1 xds configuration, so it is generated in exactly the same way.
+  string stat_prefix = 2;
+  // intentions is a list of intentions for this destination.
+  repeated L4Intention intentions = 3;
+  // max_inbound_connections specifies how many connections this destination can accept.
+  uint64 max_inbound_connections = 4;
+}
+
+message L7Destination {
+  // name is a key in the top level routes map. This specifies which route to go to in this L7 destination.
+  string name = 1;
+  // stat_prefix is for compatibility with v1 xds configuration, so it is generated in exactly the same way.
+  string stat_prefix = 2;
+  // protocol for the destination.
+  L7Protocol protocol = 3;
+  // intentions is a list of intentions for this destination.
+  repeated L7Intention intentions = 4;
+  // include_xfcc specifies whether to add xfcc header.
+  bool include_xfcc = 5;
+  // static_route specifies whether this is a static route that is inlined in the listener filter. This is required to
+  // match existing xds config.
+  bool static_route = 6;
+  // max_inbound_connections specifies how many connections this destination can accept.
+  uint64 max_inbound_connections = 7;
+}
+
+enum L7Protocol {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  L7_PROTOCOL_HTTP = 0;
+  L7_PROTOCOL_HTTP2 = 1;
+  L7_PROTOCOL_GRPC = 2;
+}
+
+message SNIDestination {
+  // stat_prefix is for compatibility with v1 xds configuration, so it is generated in exactly the same way.
+  string stat_prefix = 1;
+}

proto-public/pbmesh/v1alpha1/proxy_state.pb.binary.go

@@ -0,0 +1,28 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/proxy_state.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ProxyStateTemplate) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ProxyStateTemplate) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ProxyState) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ProxyState) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/proxy_state.pb.go

@@ -0,0 +1,552 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/proxy_state.proto
+
+package meshv1alpha1
+
+import (
+	pbresource "github.com/hashicorp/consul/proto-public/pbresource"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ProxyStateTemplate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// proxy_state is the partially filled out ProxyState resource. The Endpoints, LeafCertificates and TrustBundles fields will need filling in after the resource is stored.
+	ProxyState *ProxyState `protobuf:"bytes,1,opt,name=proxy_state,json=proxyState,proto3" json:"proxy_state,omitempty"`
+	// required_endpoints is a map of arbitrary string names to endpoint refs that need fetching by the proxy state controller.
+	RequiredEndpoints map[string]*EndpointRef `protobuf:"bytes,2,rep,name=required_endpoints,json=requiredEndpoints,proto3" json:"required_endpoints,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// required_leaf_certificates is a map of arbitrary string names to leaf certificates that need fetching/generation by the proxy state controller.
+	RequiredLeafCertificates map[string]*LeafCertificateRef `protobuf:"bytes,3,rep,name=required_leaf_certificates,json=requiredLeafCertificates,proto3" json:"required_leaf_certificates,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// required_trust_bundles is a map of arbitrary string names to trust bundle refs that need fetching by the proxy state controller.
+	RequiredTrustBundles map[string]*TrustBundleRef `protobuf:"bytes,4,rep,name=required_trust_bundles,json=requiredTrustBundles,proto3" json:"required_trust_bundles,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *ProxyStateTemplate) Reset() {
+	*x = ProxyStateTemplate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_proxy_state_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProxyStateTemplate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProxyStateTemplate) ProtoMessage() {}
+
+func (x *ProxyStateTemplate) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_proxy_state_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProxyStateTemplate.ProtoReflect.Descriptor instead.
+func (*ProxyStateTemplate) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_state_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ProxyStateTemplate) GetProxyState() *ProxyState {
+	if x != nil {
+		return x.ProxyState
+	}
+	return nil
+}
+
+func (x *ProxyStateTemplate) GetRequiredEndpoints() map[string]*EndpointRef {
+	if x != nil {
+		return x.RequiredEndpoints
+	}
+	return nil
+}
+
+func (x *ProxyStateTemplate) GetRequiredLeafCertificates() map[string]*LeafCertificateRef {
+	if x != nil {
+		return x.RequiredLeafCertificates
+	}
+	return nil
+}
+
+func (x *ProxyStateTemplate) GetRequiredTrustBundles() map[string]*TrustBundleRef {
+	if x != nil {
+		return x.RequiredTrustBundles
+	}
+	return nil
+}
+
+type ProxyState struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// id is this proxy's ID.
+	Id *pbresource.ID `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// listeners is a list of listeners for this proxy.
+	Listeners []*Listener `protobuf:"bytes,2,rep,name=listeners,proto3" json:"listeners,omitempty"`
+	// clusters is a map from cluster name to clusters. The keys are referenced from listeners or routes.
+	Clusters map[string]*Cluster `protobuf:"bytes,3,rep,name=clusters,proto3" json:"clusters,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// routes is a map from route name to routes. The keys are referenced from listeners.
+	Routes map[string]*Route `protobuf:"bytes,4,rep,name=routes,proto3" json:"routes,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// endpoints is a map from cluster name to endpoints.
+	Endpoints map[string]*Endpoints `protobuf:"bytes,5,rep,name=endpoints,proto3" json:"endpoints,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// leaf certificates is a map from UUID to leaf certificates.
+	LeafCertificates map[string]*LeafCertificate `protobuf:"bytes,6,rep,name=leaf_certificates,json=leafCertificates,proto3" json:"leaf_certificates,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// trust bundles is a map from peer name to trust bundles.
+	TrustBundles map[string]*TrustBundle `protobuf:"bytes,7,rep,name=trust_bundles,json=trustBundles,proto3" json:"trust_bundles,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// tls has TLS configuration for this proxy.
+	Tls *TLS `protobuf:"bytes,8,opt,name=tls,proto3" json:"tls,omitempty"`
+	// intention_default_allow is the default action for intentions. This determines how the Envoy RBAC filters are generated.
+	IntentionDefaultAllow bool `protobuf:"varint,9,opt,name=intention_default_allow,json=intentionDefaultAllow,proto3" json:"intention_default_allow,omitempty"`
+	// escape defines top level escape hatches. These are user configured json strings that configure an entire piece of listener or cluster Envoy configuration.
+	Escape *EscapeHatches `protobuf:"bytes,10,opt,name=escape,proto3" json:"escape,omitempty"`
+	// access_logs configures access logging for this proxy.
+	AccessLogs *AccessLogs `protobuf:"bytes,11,opt,name=access_logs,json=accessLogs,proto3" json:"access_logs,omitempty"`
+}
+
+func (x *ProxyState) Reset() {
+	*x = ProxyState{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_proxy_state_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProxyState) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProxyState) ProtoMessage() {}
+
+func (x *ProxyState) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_proxy_state_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProxyState.ProtoReflect.Descriptor instead.
+func (*ProxyState) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_proxy_state_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ProxyState) GetId() *pbresource.ID {
+	if x != nil {
+		return x.Id
+	}
+	return nil
+}
+
+func (x *ProxyState) GetListeners() []*Listener {
+	if x != nil {
+		return x.Listeners
+	}
+	return nil
+}
+
+func (x *ProxyState) GetClusters() map[string]*Cluster {
+	if x != nil {
+		return x.Clusters
+	}
+	return nil
+}
+
+func (x *ProxyState) GetRoutes() map[string]*Route {
+	if x != nil {
+		return x.Routes
+	}
+	return nil
+}
+
+func (x *ProxyState) GetEndpoints() map[string]*Endpoints {
+	if x != nil {
+		return x.Endpoints
+	}
+	return nil
+}
+
+func (x *ProxyState) GetLeafCertificates() map[string]*LeafCertificate {
+	if x != nil {
+		return x.LeafCertificates
+	}
+	return nil
+}
+
+func (x *ProxyState) GetTrustBundles() map[string]*TrustBundle {
+	if x != nil {
+		return x.TrustBundles
+	}
+	return nil
+}
+
+func (x *ProxyState) GetTls() *TLS {
+	if x != nil {
+		return x.Tls
+	}
+	return nil
+}
+
+func (x *ProxyState) GetIntentionDefaultAllow() bool {
+	if x != nil {
+		return x.IntentionDefaultAllow
+	}
+	return false
+}
+
+func (x *ProxyState) GetEscape() *EscapeHatches {
+	if x != nil {
+		return x.Escape
+	}
+	return nil
+}
+
+func (x *ProxyState) GetAccessLogs() *AccessLogs {
+	if x != nil {
+		return x.AccessLogs
+	}
+	return nil
+}
+
+var File_pbmesh_v1alpha1_proxy_state_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_proxy_state_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x1a, 0x21, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1d, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x24, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x65, 0x73, 0x63, 0x61, 0x70, 0x65, 0x5f, 0x68,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x70, 0x62,
+	0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6c, 0x69,
+	0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x70, 0x62,
+	0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x72, 0x65,
+	0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b,
+	0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f,
+	0x72, 0x6f, 0x75, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x26, 0x70, 0x62, 0x6d,
+	0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x74, 0x72, 0x61,
+	0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xde,
+	0x06, 0x0a, 0x12, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x54, 0x65, 0x6d,
+	0x70, 0x6c, 0x61, 0x74, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65,
+	0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x12, 0x78, 0x0a, 0x12, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x5f, 0x65,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x49,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x45, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x11, 0x72, 0x65, 0x71, 0x75, 0x69,
+	0x72, 0x65, 0x64, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x8e, 0x01, 0x0a,
+	0x1a, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x5f, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x50, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x54, 0x65, 0x6d,
+	0x70, 0x6c, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4c, 0x65,
+	0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x18, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4c, 0x65, 0x61,
+	0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x82, 0x01,
+	0x0a, 0x16, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x5f, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x5f, 0x62, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x4c,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x54, 0x72, 0x75, 0x73, 0x74,
+	0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x14, 0x72, 0x65,
+	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c,
+	0x65, 0x73, 0x1a, 0x71, 0x0a, 0x16, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x41,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
+	0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52, 0x65, 0x66, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x7f, 0x0a, 0x1d, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65,
+	0x64, 0x4c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x48, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72,
+	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x66, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x77, 0x0a, 0x19, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72,
+	0x65, 0x64, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x44, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c,
+	0x65, 0x52, 0x65, 0x66, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22,
+	0xec, 0x0a, 0x0a, 0x0a, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2d,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x46, 0x0a,
+	0x09, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x28, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x09, 0x6c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x54, 0x0a, 0x08, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x2e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x08, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x4e, 0x0a, 0x06, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d,
+	0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x57, 0x0a, 0x09, 0x65,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x39,
+	0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x45, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x73, 0x12, 0x6d, 0x0a, 0x11, 0x6c, 0x65, 0x61, 0x66, 0x5f, 0x63, 0x65, 0x72,
+	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x40, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x4c, 0x65, 0x61, 0x66,
+	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x10, 0x6c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x73, 0x12, 0x61, 0x0a, 0x0d, 0x74, 0x72, 0x75, 0x73, 0x74, 0x5f, 0x62, 0x75, 0x6e,
+	0x64, 0x6c, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3c, 0x2e, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65,
+	0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x2e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64,
+	0x6c, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74, 0x42,
+	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x03, 0x74, 0x6c, 0x73, 0x18, 0x08, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x4c, 0x53, 0x52, 0x03, 0x74, 0x6c, 0x73, 0x12, 0x36, 0x0a,
+	0x17, 0x69, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x64, 0x65, 0x66, 0x61, 0x75,
+	0x6c, 0x74, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x15,
+	0x69, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x12, 0x45, 0x0a, 0x06, 0x65, 0x73, 0x63, 0x61, 0x70, 0x65, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x73, 0x63, 0x61, 0x70, 0x65, 0x48, 0x61, 0x74,
+	0x63, 0x68, 0x65, 0x73, 0x52, 0x06, 0x65, 0x73, 0x63, 0x61, 0x70, 0x65, 0x12, 0x4b, 0x0a, 0x0b,
+	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2a, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x0a, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x73, 0x1a, 0x64, 0x0a, 0x0d, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3d, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d,
+	0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a,
+	0x60, 0x0a, 0x0b, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x3b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x25, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
+	0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x1a, 0x67, 0x0a, 0x0e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3f, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x74, 0x0a, 0x15, 0x4c, 0x65,
+	0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x45, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x1a, 0x6c, 0x0a, 0x11, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x41, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e,
+	0x64, 0x6c, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x97,
+	0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x0f, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2,
+	0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
+	0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a,
+	0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_proxy_state_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_proxy_state_proto_rawDescData = file_pbmesh_v1alpha1_proxy_state_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_proxy_state_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_proxy_state_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_proxy_state_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_proxy_state_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_proxy_state_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_proxy_state_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_pbmesh_v1alpha1_proxy_state_proto_goTypes = []interface{}{
+	(*ProxyStateTemplate)(nil), // 0: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate
+	(*ProxyState)(nil),         // 1: hashicorp.consul.mesh.v1alpha1.ProxyState
+	nil,                        // 2: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredEndpointsEntry
+	nil,                        // 3: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredLeafCertificatesEntry
+	nil,                        // 4: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredTrustBundlesEntry
+	nil,                        // 5: hashicorp.consul.mesh.v1alpha1.ProxyState.ClustersEntry
+	nil,                        // 6: hashicorp.consul.mesh.v1alpha1.ProxyState.RoutesEntry
+	nil,                        // 7: hashicorp.consul.mesh.v1alpha1.ProxyState.EndpointsEntry
+	nil,                        // 8: hashicorp.consul.mesh.v1alpha1.ProxyState.LeafCertificatesEntry
+	nil,                        // 9: hashicorp.consul.mesh.v1alpha1.ProxyState.TrustBundlesEntry
+	(*pbresource.ID)(nil),      // 10: hashicorp.consul.resource.ID
+	(*Listener)(nil),           // 11: hashicorp.consul.mesh.v1alpha1.Listener
+	(*TLS)(nil),                // 12: hashicorp.consul.mesh.v1alpha1.TLS
+	(*EscapeHatches)(nil),      // 13: hashicorp.consul.mesh.v1alpha1.EscapeHatches
+	(*AccessLogs)(nil),         // 14: hashicorp.consul.mesh.v1alpha1.AccessLogs
+	(*EndpointRef)(nil),        // 15: hashicorp.consul.mesh.v1alpha1.EndpointRef
+	(*LeafCertificateRef)(nil), // 16: hashicorp.consul.mesh.v1alpha1.LeafCertificateRef
+	(*TrustBundleRef)(nil),     // 17: hashicorp.consul.mesh.v1alpha1.TrustBundleRef
+	(*Cluster)(nil),            // 18: hashicorp.consul.mesh.v1alpha1.Cluster
+	(*Route)(nil),              // 19: hashicorp.consul.mesh.v1alpha1.Route
+	(*Endpoints)(nil),          // 20: hashicorp.consul.mesh.v1alpha1.Endpoints
+	(*LeafCertificate)(nil),    // 21: hashicorp.consul.mesh.v1alpha1.LeafCertificate
+	(*TrustBundle)(nil),        // 22: hashicorp.consul.mesh.v1alpha1.TrustBundle
+}
+var file_pbmesh_v1alpha1_proxy_state_proto_depIdxs = []int32{
+	1,  // 0: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.proxy_state:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyState
+	2,  // 1: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.required_endpoints:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredEndpointsEntry
+	3,  // 2: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.required_leaf_certificates:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredLeafCertificatesEntry
+	4,  // 3: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.required_trust_bundles:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredTrustBundlesEntry
+	10, // 4: hashicorp.consul.mesh.v1alpha1.ProxyState.id:type_name -> hashicorp.consul.resource.ID
+	11, // 5: hashicorp.consul.mesh.v1alpha1.ProxyState.listeners:type_name -> hashicorp.consul.mesh.v1alpha1.Listener
+	5,  // 6: hashicorp.consul.mesh.v1alpha1.ProxyState.clusters:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyState.ClustersEntry
+	6,  // 7: hashicorp.consul.mesh.v1alpha1.ProxyState.routes:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyState.RoutesEntry
+	7,  // 8: hashicorp.consul.mesh.v1alpha1.ProxyState.endpoints:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyState.EndpointsEntry
+	8,  // 9: hashicorp.consul.mesh.v1alpha1.ProxyState.leaf_certificates:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyState.LeafCertificatesEntry
+	9,  // 10: hashicorp.consul.mesh.v1alpha1.ProxyState.trust_bundles:type_name -> hashicorp.consul.mesh.v1alpha1.ProxyState.TrustBundlesEntry
+	12, // 11: hashicorp.consul.mesh.v1alpha1.ProxyState.tls:type_name -> hashicorp.consul.mesh.v1alpha1.TLS
+	13, // 12: hashicorp.consul.mesh.v1alpha1.ProxyState.escape:type_name -> hashicorp.consul.mesh.v1alpha1.EscapeHatches
+	14, // 13: hashicorp.consul.mesh.v1alpha1.ProxyState.access_logs:type_name -> hashicorp.consul.mesh.v1alpha1.AccessLogs
+	15, // 14: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredEndpointsEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.EndpointRef
+	16, // 15: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredLeafCertificatesEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.LeafCertificateRef
+	17, // 16: hashicorp.consul.mesh.v1alpha1.ProxyStateTemplate.RequiredTrustBundlesEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.TrustBundleRef
+	18, // 17: hashicorp.consul.mesh.v1alpha1.ProxyState.ClustersEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.Cluster
+	19, // 18: hashicorp.consul.mesh.v1alpha1.ProxyState.RoutesEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.Route
+	20, // 19: hashicorp.consul.mesh.v1alpha1.ProxyState.EndpointsEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.Endpoints
+	21, // 20: hashicorp.consul.mesh.v1alpha1.ProxyState.LeafCertificatesEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.LeafCertificate
+	22, // 21: hashicorp.consul.mesh.v1alpha1.ProxyState.TrustBundlesEntry.value:type_name -> hashicorp.consul.mesh.v1alpha1.TrustBundle
+	22, // [22:22] is the sub-list for method output_type
+	22, // [22:22] is the sub-list for method input_type
+	22, // [22:22] is the sub-list for extension type_name
+	22, // [22:22] is the sub-list for extension extendee
+	0,  // [0:22] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_proxy_state_proto_init() }
+func file_pbmesh_v1alpha1_proxy_state_proto_init() {
+	if File_pbmesh_v1alpha1_proxy_state_proto != nil {
+		return
+	}
+	file_pbmesh_v1alpha1_access_logs_proto_init()
+	file_pbmesh_v1alpha1_cluster_proto_init()
+	file_pbmesh_v1alpha1_endpoints_proto_init()
+	file_pbmesh_v1alpha1_escape_hatches_proto_init()
+	file_pbmesh_v1alpha1_listener_proto_init()
+	file_pbmesh_v1alpha1_references_proto_init()
+	file_pbmesh_v1alpha1_route_proto_init()
+	file_pbmesh_v1alpha1_transport_socket_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_proxy_state_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProxyStateTemplate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_proxy_state_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProxyState); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_proxy_state_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   10,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_proxy_state_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_proxy_state_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_proxy_state_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_proxy_state_proto = out.File
+	file_pbmesh_v1alpha1_proxy_state_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_proxy_state_proto_goTypes = nil
+	file_pbmesh_v1alpha1_proxy_state_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/proxy_state.proto

@@ -0,0 +1,55 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "pbmesh/v1alpha1/access_logs.proto";
+import "pbmesh/v1alpha1/cluster.proto";
+import "pbmesh/v1alpha1/endpoints.proto";
+import "pbmesh/v1alpha1/escape_hatches.proto";
+import "pbmesh/v1alpha1/listener.proto";
+import "pbmesh/v1alpha1/references.proto";
+import "pbmesh/v1alpha1/route.proto";
+import "pbmesh/v1alpha1/transport_socket.proto";
+import "pbresource/resource.proto";
+
+message ProxyStateTemplate {
+  // proxy_state is the partially filled out ProxyState resource. The Endpoints, LeafCertificates and TrustBundles fields will need filling in after the resource is stored.
+  ProxyState proxy_state = 1;
+
+  // required_endpoints is a map of arbitrary string names to endpoint refs that need fetching by the proxy state controller.
+  map<string, EndpointRef> required_endpoints = 2;
+
+  // required_leaf_certificates is a map of arbitrary string names to leaf certificates that need fetching/generation by the proxy state controller.
+  map<string, LeafCertificateRef> required_leaf_certificates = 3;
+
+  // required_trust_bundles is a map of arbitrary string names to trust bundle refs that need fetching by the proxy state controller.
+  map<string, TrustBundleRef> required_trust_bundles = 4;
+}
+
+message ProxyState {
+  // id is this proxy's ID.
+  hashicorp.consul.resource.ID id = 1;
+  // listeners is a list of listeners for this proxy.
+  repeated Listener listeners = 2;
+  // clusters is a map from cluster name to clusters. The keys are referenced from listeners or routes.
+  map<string, Cluster> clusters = 3;
+  // routes is a map from route name to routes. The keys are referenced from listeners.
+  map<string, Route> routes = 4;
+  // endpoints is a map from cluster name to endpoints.
+  map<string, Endpoints> endpoints = 5;
+  // leaf certificates is a map from UUID to leaf certificates.
+  map<string, LeafCertificate> leaf_certificates = 6;
+  // trust bundles is a map from peer name to trust bundles.
+  map<string, TrustBundle> trust_bundles = 7;
+  // tls has TLS configuration for this proxy.
+  TLS tls = 8;
+  // intention_default_allow is the default action for intentions. This determines how the Envoy RBAC filters are generated.
+  bool intention_default_allow = 9;
+  // escape defines top level escape hatches. These are user configured json strings that configure an entire piece of listener or cluster Envoy configuration.
+  EscapeHatches escape = 10;
+  // access_logs configures access logging for this proxy.
+  AccessLogs access_logs = 11;
+}

proto-public/pbmesh/v1alpha1/references.pb.binary.go

@@ -0,0 +1,38 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/references.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LeafCertificateRef) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LeafCertificateRef) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TrustBundleRef) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TrustBundleRef) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *EndpointRef) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *EndpointRef) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/references.pb.go

@@ -0,0 +1,365 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        (unknown)
+// source: pbmesh/v1alpha1/references.proto
+
+package meshv1alpha1
+
+import (
+	pbresource "github.com/hashicorp/consul/proto-public/pbresource"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type LeafCertificateRef struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name       string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Namespace  string   `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Partition  string   `protobuf:"bytes,3,opt,name=partition,proto3" json:"partition,omitempty"`
+	Host       string   `protobuf:"bytes,4,opt,name=host,proto3" json:"host,omitempty"`
+	Datacenter string   `protobuf:"bytes,5,opt,name=datacenter,proto3" json:"datacenter,omitempty"`
+	DnsSan     []string `protobuf:"bytes,6,rep,name=dns_san,json=dnsSan,proto3" json:"dns_san,omitempty"`
+}
+
+func (x *LeafCertificateRef) Reset() {
+	*x = LeafCertificateRef{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_references_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LeafCertificateRef) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LeafCertificateRef) ProtoMessage() {}
+
+func (x *LeafCertificateRef) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_references_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LeafCertificateRef.ProtoReflect.Descriptor instead.
+func (*LeafCertificateRef) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_references_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *LeafCertificateRef) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *LeafCertificateRef) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *LeafCertificateRef) GetPartition() string {
+	if x != nil {
+		return x.Partition
+	}
+	return ""
+}
+
+func (x *LeafCertificateRef) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *LeafCertificateRef) GetDatacenter() string {
+	if x != nil {
+		return x.Datacenter
+	}
+	return ""
+}
+
+func (x *LeafCertificateRef) GetDnsSan() []string {
+	if x != nil {
+		return x.DnsSan
+	}
+	return nil
+}
+
+type TrustBundleRef struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Peer        string `protobuf:"bytes,1,opt,name=peer,proto3" json:"peer,omitempty"`
+	TrustDomain string `protobuf:"bytes,2,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
+}
+
+func (x *TrustBundleRef) Reset() {
+	*x = TrustBundleRef{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_references_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TrustBundleRef) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TrustBundleRef) ProtoMessage() {}
+
+func (x *TrustBundleRef) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_references_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TrustBundleRef.ProtoReflect.Descriptor instead.
+func (*TrustBundleRef) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_references_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *TrustBundleRef) GetPeer() string {
+	if x != nil {
+		return x.Peer
+	}
+	return ""
+}
+
+func (x *TrustBundleRef) GetTrustDomain() string {
+	if x != nil {
+		return x.TrustDomain
+	}
+	return ""
+}
+
+type EndpointRef struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// id is the ServiceEndpoints resource id.
+	Id *pbresource.ID `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// port is the name of the port in the ServiceEndpoints to generate the Endpoints from.
+	Port string `protobuf:"bytes,2,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *EndpointRef) Reset() {
+	*x = EndpointRef{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_pbmesh_v1alpha1_references_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EndpointRef) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EndpointRef) ProtoMessage() {}
+
+func (x *EndpointRef) ProtoReflect() protoreflect.Message {
+	mi := &file_pbmesh_v1alpha1_references_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EndpointRef.ProtoReflect.Descriptor instead.
+func (*EndpointRef) Descriptor() ([]byte, []int) {
+	return file_pbmesh_v1alpha1_references_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *EndpointRef) GetId() *pbresource.ID {
+	if x != nil {
+		return x.Id
+	}
+	return nil
+}
+
+func (x *EndpointRef) GetPort() string {
+	if x != nil {
+		return x.Port
+	}
+	return ""
+}
+
+var File_pbmesh_v1alpha1_references_proto protoreflect.FileDescriptor
+
+var file_pbmesh_v1alpha1_references_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x1e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x1a, 0x19, 0x70, 0x62, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb1, 0x01,
+	0x0a, 0x12, 0x4c, 0x65, 0x61, 0x66, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x66, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x70, 0x61, 0x72, 0x74, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x61, 0x72, 0x74, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x61, 0x74, 0x61,
+	0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x61,
+	0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x6e, 0x73, 0x5f,
+	0x73, 0x61, 0x6e, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6e, 0x73, 0x53, 0x61,
+	0x6e, 0x22, 0x47, 0x0a, 0x0e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65,
+	0x52, 0x65, 0x66, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x65, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x70, 0x65, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x72, 0x75, 0x73, 0x74,
+	0x5f, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x74,
+	0x72, 0x75, 0x73, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x50, 0x0a, 0x0b, 0x45, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x52, 0x65, 0x66, 0x12, 0x2d, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x49, 0x44, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x42, 0x97, 0x02, 0x0a,
+	0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x42, 0x0f, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x73, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03,
+	0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72,
+	0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a,
+	0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_pbmesh_v1alpha1_references_proto_rawDescOnce sync.Once
+	file_pbmesh_v1alpha1_references_proto_rawDescData = file_pbmesh_v1alpha1_references_proto_rawDesc
+)
+
+func file_pbmesh_v1alpha1_references_proto_rawDescGZIP() []byte {
+	file_pbmesh_v1alpha1_references_proto_rawDescOnce.Do(func() {
+		file_pbmesh_v1alpha1_references_proto_rawDescData = protoimpl.X.CompressGZIP(file_pbmesh_v1alpha1_references_proto_rawDescData)
+	})
+	return file_pbmesh_v1alpha1_references_proto_rawDescData
+}
+
+var file_pbmesh_v1alpha1_references_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_pbmesh_v1alpha1_references_proto_goTypes = []interface{}{
+	(*LeafCertificateRef)(nil), // 0: hashicorp.consul.mesh.v1alpha1.LeafCertificateRef
+	(*TrustBundleRef)(nil),     // 1: hashicorp.consul.mesh.v1alpha1.TrustBundleRef
+	(*EndpointRef)(nil),        // 2: hashicorp.consul.mesh.v1alpha1.EndpointRef
+	(*pbresource.ID)(nil),      // 3: hashicorp.consul.resource.ID
+}
+var file_pbmesh_v1alpha1_references_proto_depIdxs = []int32{
+	3, // 0: hashicorp.consul.mesh.v1alpha1.EndpointRef.id:type_name -> hashicorp.consul.resource.ID
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_pbmesh_v1alpha1_references_proto_init() }
+func file_pbmesh_v1alpha1_references_proto_init() {
+	if File_pbmesh_v1alpha1_references_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_pbmesh_v1alpha1_references_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LeafCertificateRef); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_references_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TrustBundleRef); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_pbmesh_v1alpha1_references_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EndpointRef); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_pbmesh_v1alpha1_references_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_pbmesh_v1alpha1_references_proto_goTypes,
+		DependencyIndexes: file_pbmesh_v1alpha1_references_proto_depIdxs,
+		MessageInfos:      file_pbmesh_v1alpha1_references_proto_msgTypes,
+	}.Build()
+	File_pbmesh_v1alpha1_references_proto = out.File
+	file_pbmesh_v1alpha1_references_proto_rawDesc = nil
+	file_pbmesh_v1alpha1_references_proto_goTypes = nil
+	file_pbmesh_v1alpha1_references_proto_depIdxs = nil
+}

proto-public/pbmesh/v1alpha1/references.proto

@@ -0,0 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "pbresource/resource.proto";
+
+message LeafCertificateRef {
+  string name = 1;
+  string namespace = 2;
+  string partition = 3;
+  string host = 4;
+  string datacenter = 5;
+  repeated string dns_san = 6;
+}
+
+message TrustBundleRef {
+  string peer = 1;
+  string trust_domain = 2;
+}
+
+message EndpointRef {
+  // id is the ServiceEndpoints resource id.
+  hashicorp.consul.resource.ID id = 1;
+  // port is the name of the port in the ServiceEndpoints to generate the Endpoints from.
+  string port = 2;
+}

proto-public/pbmesh/v1alpha1/route.pb.binary.go

@@ -0,0 +1,178 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/route.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *Route) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *Route) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *VirtualHost) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *VirtualHost) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *RouteRule) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *RouteRule) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *RouteMatch) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *RouteMatch) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *PathMatch) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *PathMatch) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *QueryParameterMatch) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *QueryParameterMatch) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HeaderMatch) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HeaderMatch) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *RouteDestination) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *RouteDestination) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DestinationConfiguration) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DestinationConfiguration) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *RetryPolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *RetryPolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TimeoutConfig) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TimeoutConfig) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LoadBalancerHashPolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LoadBalancerHashPolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *CookiePolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *CookiePolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *HeaderPolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *HeaderPolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *QueryParameterPolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *QueryParameterPolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *ConnectionPropertiesPolicy) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *ConnectionPropertiesPolicy) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *DestinationCluster) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *DestinationCluster) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/route.proto

@@ -0,0 +1,138 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
+import "pbmesh/v1alpha1/cluster.proto";
+import "pbmesh/v1alpha1/header_mutations.proto";
+
+message Route {
+  // name is the name of the route.
+  string name = 1;
+  // virtual_hosts is a list of virtual hosts. A virtual host is selected based on an incoming request's host header.
+  repeated VirtualHost virtual_hosts = 2;
+}
+
+message VirtualHost {
+  string name = 1;
+  // domains are used to match an incoming request's host header and determine which virtual host to use.
+  repeated string domains = 2;
+  // header_mutations to apply to the request when it matches this virtual host. These are applied after any headers in
+  // the RouteRule.
+  repeated HeaderMutation header_mutations = 3;
+  // route_rules are a list of rules to use for what to do next with this request. The first rule with a match will be
+  // used.
+  repeated RouteRule route_rules = 4;
+}
+
+message RouteRule {
+  // match determines how to match the request. The first match determines which destination the request will go to.
+  RouteMatch match = 1;
+  // destination is where to send the request to.
+  RouteDestination destination = 2;
+  // header_mutations to apply to the request. These are applied before the VirtualHost header mutations.
+  repeated HeaderMutation header_mutations = 3;
+}
+
+// RouteMatch has configuration to match a request.
+message RouteMatch {
+  PathMatch path_match = 1;
+  repeated HeaderMatch header_matches = 2;
+  repeated string method_matches = 3;
+  repeated QueryParameterMatch query_parameter_matches = 4;
+}
+
+message PathMatch {
+  oneof path_match {
+    string exact = 1;
+    string prefix = 2;
+    string regex = 3;
+  }
+}
+
+message QueryParameterMatch {
+  string name = 1;
+  oneof match {
+    string exact = 2;
+    string regex = 3;
+    bool present = 4;
+  }
+}
+
+message HeaderMatch {
+  string name = 1;
+  oneof match {
+    string exact = 2;
+    string prefix = 3;
+    string suffix = 4;
+    string regex = 5;
+    bool present = 6;
+  }
+  bool invert_match = 7;
+}
+
+// RouteDestination has configuration for where to send a request.
+message RouteDestination {
+  // destination is one or more clusters to route to.
+  oneof destination {
+    DestinationCluster cluster = 1;
+    L7WeightedClusterGroup weighted_clusters = 2;
+  }
+  DestinationConfiguration destination_configuration = 3;
+}
+
+message DestinationConfiguration {
+  google.protobuf.BoolValue auto_host_rewrite = 1;
+  repeated LoadBalancerHashPolicy hash_policies = 2;
+  TimeoutConfig timeout_config = 3;
+  string prefix_rewrite = 4;
+  RetryPolicy retry_policy = 5;
+}
+
+message RetryPolicy {
+  string retry_on = 1;
+  google.protobuf.UInt32Value num_retries = 2;
+  repeated uint32 retriable_status_codes = 3;
+}
+
+message TimeoutConfig {
+  google.protobuf.Duration timeout = 1;
+  google.protobuf.Duration idle_timeout = 2;
+}
+
+message LoadBalancerHashPolicy {
+  oneof policy {
+    CookiePolicy cookie = 1;
+    HeaderPolicy header = 2;
+    QueryParameterPolicy query_parameter = 3;
+    ConnectionPropertiesPolicy connection_properties = 4;
+  }
+}
+
+message CookiePolicy {
+  string name = 1;
+  google.protobuf.Duration ttl = 2;
+  string path = 3;
+  bool terminal = 4;
+}
+message HeaderPolicy {
+  string name = 1;
+  bool terminal = 2;
+}
+message QueryParameterPolicy {
+  string name = 1;
+  bool terminal = 2;
+}
+message ConnectionPropertiesPolicy {
+  bool source_ip = 1;
+  bool terminal = 2;
+}
+
+message DestinationCluster {
+  // name is the name of the cluster. This will be used to look up a cluster in the clusters map.
+  string name = 1;
+}

proto-public/pbmesh/v1alpha1/transport_socket.pb.binary.go

@@ -0,0 +1,138 @@
+// Code generated by protoc-gen-go-binary. DO NOT EDIT.
+// source: pbmesh/v1alpha1/transport_socket.proto
+
+package meshv1alpha1
+
+import (
+	"google.golang.org/protobuf/proto"
+)
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TLS) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TLS) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TransportSocket) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TransportSocket) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *InboundMeshMTLS) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *InboundMeshMTLS) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *OutboundMeshMTLS) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *OutboundMeshMTLS) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *InboundNonMeshTLS) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *InboundNonMeshTLS) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *OutboundNonMeshTLS) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *OutboundNonMeshTLS) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *MeshInboundValidationContext) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *MeshInboundValidationContext) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *MeshOutboundValidationContext) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *MeshOutboundValidationContext) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *NonMeshOutboundValidationContext) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *NonMeshOutboundValidationContext) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *SDSCertificate) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *SDSCertificate) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TLSParameters) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TLSParameters) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *LeafCertificate) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *LeafCertificate) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler
+func (msg *TrustBundle) MarshalBinary() ([]byte, error) {
+	return proto.Marshal(msg)
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler
+func (msg *TrustBundle) UnmarshalBinary(b []byte) error {
+	return proto.Unmarshal(b, msg)
+}

proto-public/pbmesh/v1alpha1/transport_socket.proto

@@ -0,0 +1,136 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package hashicorp.consul.mesh.v1alpha1;
+
+message TLS {
+  // inbound_tls_parameters has default TLS parameter configuration for inbound connections. These can be overridden per
+  // transport socket.
+  TLSParameters inbound_tls_parameters = 1;
+  // outbound_tls_parameters has default TLS parameter configuration for inbound connections. These can be overridden per transport socket.
+  TLSParameters outbound_tls_parameters = 2;
+  // TrustBundles is a map of peer name to trust domain. The V2 resource tenancy field will have the peer, which will be either local, or have a peer name. The map keys would be "local" or the name of the peer if it is for a remote peer. The peer name and trust domain will be used to look up CA pems for a trust domain.
+  map<string, string> trust_bundles = 3;
+}
+
+message TransportSocket {
+  oneof connection_tls {
+    // inbound_mesh is for incoming connections FROM the mesh.
+    InboundMeshMTLS inbound_mesh = 1;
+    // outbound_mesh is for outbound connections TO mesh destinations.
+    OutboundMeshMTLS outbound_mesh = 2;
+    // inbound_non_mesh is for incoming connections FROM non mesh.
+    InboundNonMeshTLS inbound_non_mesh = 3;
+    // outbound_non_mesh is for outbound connections TO non mesh destinations.
+    OutboundNonMeshTLS outbound_non_mesh = 4;
+  }
+  // tls_parameters can override any top level tls parameters that are configured.
+  TLSParameters tls_parameters = 5;
+  repeated string alpn_protocols = 6;
+}
+
+message InboundMeshMTLS {
+  // identity_key is UUID key to use to look up the leaf certificate in ProxyState to present for incoming connections.
+  string identity_key = 1;
+  // validation_context has what is needed to validate incoming connections.
+  MeshInboundValidationContext validation_context = 2;
+}
+
+message OutboundMeshMTLS {
+  // identity_key is UUID key to use to look up the leaf certificate in ProxyState when connecting to destinations.
+  string identity_key = 1;
+  // validation_context has what is needed to validate the destination.
+  MeshOutboundValidationContext validation_context = 2;
+  // sni to use when connecting to the destination.
+  string sni = 3;
+}
+
+message InboundNonMeshTLS {
+  // identity is the reference to the leaf certificate to present for incoming connections.
+  oneof identity {
+    // leaf_key is the UUID key to use to look up the leaf certificate in the ProxyState leaf certificate map.
+    string leaf_key = 1;
+    // sds refers to certificates retrieved via Envoy SDS.
+    SDSCertificate sds = 2;
+  }
+}
+
+message OutboundNonMeshTLS {
+  // cert_file is a filename for a certificate to present for outbound connections.
+  string cert_file = 1;
+  // key_file is a filename for a key for outbound connections.
+  string key_file = 2;
+  // validation_context has what is needed to validate the destination.
+  NonMeshOutboundValidationContext validation_context = 3;
+}
+
+message MeshInboundValidationContext {
+  // trust_bundle_peer_name_keys is which trust bundles to use for validating incoming connections. If this workload is exported
+  // to peers, the incoming connection could be from a different peer, requiring that trust bundle to validate the
+  // connection. These could be local or peered trust bundles. This will be a key in the trust bundle map.
+  repeated string trust_bundle_peer_name_keys = 1;
+}
+
+message MeshOutboundValidationContext {
+  // trust_bundle_peer_name_key is which trust bundle to use for the destination. It could be the local or a peer's trust bundle.
+  // This will be a key in the trust bundle map.
+  string trust_bundle_peer_name_key = 1;
+  // spiffe_ids is one or more spiffe IDs to validate.
+  repeated string spiffe_ids = 2;
+}
+
+message NonMeshOutboundValidationContext {
+  // ca_file is a filename for a ca for outbound connections to validate the destination.
+  string ca_file = 1;
+}
+
+message SDSCertificate {
+  string cluster_name = 1;
+  string cert_resource = 2;
+}
+
+message TLSParameters {
+  TLSVersion min_version = 1;
+  TLSVersion max_version = 2;
+  repeated TLSCipherSuite cipher_suites = 3;
+}
+
+message LeafCertificate {
+  string cert = 1;
+  string key = 2;
+}
+
+message TrustBundle {
+  string ca = 1;
+}
+
+enum TLSVersion {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  TLS_VERSION_AUTO = 0;
+  TLS_VERSION_1_0 = 1;
+  TLS_VERSION_1_1 = 2;
+  TLS_VERSION_1_2 = 3;
+  TLS_VERSION_1_3 = 4;
+  TLS_VERSION_INVALID = 5;
+  TLS_VERSION_UNSPECIFIED = 6;
+}
+
+enum TLSCipherSuite {
+  // buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
+  TLS_CIPHER_SUITE_ECDHE_ECDSA_AES128_GCM_SHA256 = 0;
+  TLS_CIPHER_SUITE_ECDHE_ECDSA_CHACHA20_POLY1305 = 1;
+  TLS_CIPHER_SUITE_ECDHE_RSA_AES128_GCM_SHA256 = 2;
+  TLS_CIPHER_SUITE_ECDHE_RSA_CHACHA20_POLY1305 = 3;
+  TLS_CIPHER_SUITE_ECDHE_ECDSA_AES128_SHA = 4;
+  TLS_CIPHER_SUITE_ECDHE_RSA_AES128_SHA = 5;
+  TLS_CIPHER_SUITE_AES128_GCM_SHA256 = 6;
+  TLS_CIPHER_SUITE_AES128_SHA = 7;
+  TLS_CIPHER_SUITE_ECDHE_ECDSA_AES256_GCM_SHA384 = 8;
+  TLS_CIPHER_SUITE_ECDHE_RSA_AES256_GCM_SHA384 = 9;
+  TLS_CIPHER_SUITE_ECDHE_ECDSA_AES256_SHA = 10;
+  TLS_CIPHER_SUITE_ECDHE_RSA_AES256_SHA = 11;
+  TLS_CIPHER_SUITE_AES256_GCM_SHA384 = 12;
+  TLS_CIPHER_SUITE_AES256_SHA = 13;
+}

proto-public/pbmesh/v1alpha1/upstreams_configuration.pb.go

@@ -15,6 +15,7 @@ import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	wrapperspb "google.golang.org/protobuf/types/known/wrapperspb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -280,16 +281,16 @@ type UpstreamLimits struct {
 
 	// max_connections is the maximum number of connections the local proxy can
 	// make to the upstream service.
-	MaxConnections int32 `protobuf:"varint,1,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
+	MaxConnections *wrapperspb.UInt32Value `protobuf:"bytes,1,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
 	// max_pending_requests is the maximum number of requests that will be queued
 	// waiting for an available connection. This is mostly applicable to HTTP/1.1
 	// clusters since all HTTP/2 requests are streamed over a single
 	// connection.
-	MaxPendingRequests int32 `protobuf:"varint,2,opt,name=max_pending_requests,json=maxPendingRequests,proto3" json:"max_pending_requests,omitempty"`
+	MaxPendingRequests *wrapperspb.UInt32Value `protobuf:"bytes,2,opt,name=max_pending_requests,json=maxPendingRequests,proto3" json:"max_pending_requests,omitempty"`
 	// max_concurrent_requests is the maximum number of in-flight requests that will be allowed
 	// to the upstream cluster at a point in time. This is mostly applicable to HTTP/2
 	// clusters since all HTTP/1.1 requests are limited by MaxConnections.
-	MaxConcurrentRequests int32 `protobuf:"varint,3,opt,name=max_concurrent_requests,json=maxConcurrentRequests,proto3" json:"max_concurrent_requests,omitempty"`
+	MaxConcurrentRequests *wrapperspb.UInt32Value `protobuf:"bytes,3,opt,name=max_concurrent_requests,json=maxConcurrentRequests,proto3" json:"max_concurrent_requests,omitempty"`
 }
 
 func (x *UpstreamLimits) Reset() {
@@ -324,25 +325,25 @@ func (*UpstreamLimits) Descriptor() ([]byte, []int) {
 	return file_pbmesh_v1alpha1_upstreams_configuration_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *UpstreamLimits) GetMaxConnections() int32 {
+func (x *UpstreamLimits) GetMaxConnections() *wrapperspb.UInt32Value {
 	if x != nil {
 		return x.MaxConnections
 	}
-	return 0
+	return nil
 }
 
-func (x *UpstreamLimits) GetMaxPendingRequests() int32 {
+func (x *UpstreamLimits) GetMaxPendingRequests() *wrapperspb.UInt32Value {
 	if x != nil {
 		return x.MaxPendingRequests
 	}
-	return 0
+	return nil
 }
 
-func (x *UpstreamLimits) GetMaxConcurrentRequests() int32 {
+func (x *UpstreamLimits) GetMaxConcurrentRequests() *wrapperspb.UInt32Value {
 	if x != nil {
 		return x.MaxConcurrentRequests
 	}
-	return 0
+	return nil
 }
 
 type PassiveHealthCheck struct {
@@ -425,6 +426,8 @@ var file_pbmesh_v1alpha1_upstreams_configuration_proto_rawDesc = []byte{
 	0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a,
 	0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
 	0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
+	0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
 	0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70,
 	0x68, 0x61, 0x31, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x1a, 0x21, 0x70, 0x62, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x2f, 0x76, 0x31,
@@ -503,47 +506,53 @@ var file_pbmesh_v1alpha1_upstreams_configuration_proto_rawDesc = []byte{
 	0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e,
 	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x47, 0x61, 0x74,
 	0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x0f, 0x6d, 0x65, 0x73, 0x68, 0x47, 0x61,
-	0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x22, 0xa3, 0x01, 0x0a, 0x0e, 0x55, 0x70,
+	0x74, 0x65, 0x77, 0x61, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x22, 0xfd, 0x01, 0x0a, 0x0e, 0x55, 0x70,
-	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x0a, 0x0f,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x45, 0x0a, 0x0f,
 	0x6d, 0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0e, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x6d, 0x61, 0x78, 0x5f, 0x70, 0x65, 0x6e,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61,
-	0x64, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x02, 0x20,
+	0x6c, 0x75, 0x65, 0x52, 0x0e, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x01, 0x28, 0x05, 0x52, 0x12, 0x6d, 0x61, 0x78, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x52,
+	0x6f, 0x6e, 0x73, 0x12, 0x4e, 0x0a, 0x14, 0x6d, 0x61, 0x78, 0x5f, 0x70, 0x65, 0x6e, 0x64, 0x69,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x12, 0x36, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x63,
+	0x6e, 0x67, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x15, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e,
+	0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-	0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22,
+	0x12, 0x6d, 0x61, 0x78, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0xaa, 0x01, 0x0a, 0x12, 0x50, 0x61, 0x73, 0x73, 0x69, 0x76, 0x65, 0x48, 0x65, 0x61, 0x6c, 0x74,
+	0x73, 0x74, 0x73, 0x12, 0x54, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e, 0x63, 0x75,
-	0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76,
+	0x72, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x03,
-	0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c,
-	0x69, 0x6f, 0x6e, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x21, 0x0a,
+	0x75, 0x65, 0x52, 0x15, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e,
-	0x0c, 0x6d, 0x61, 0x78, 0x5f, 0x66, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x73, 0x18, 0x02, 0x20,
+	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0xaa, 0x01, 0x0a, 0x12, 0x50, 0x61,
-	0x01, 0x28, 0x0d, 0x52, 0x0b, 0x6d, 0x61, 0x78, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x73,
+	0x73, 0x73, 0x69, 0x76, 0x65, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b,
-	0x12, 0x3a, 0x0a, 0x19, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f,
+	0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01,
-	0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x35, 0x78, 0x78, 0x18, 0x03, 0x20,
+	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x01, 0x28, 0x0d, 0x52, 0x17, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x43, 0x6f,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x69,
-	0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x35, 0x78, 0x78, 0x42, 0xa3, 0x02, 0x0a,
+	0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x78, 0x5f, 0x66,
-	0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63,
+	0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x6d,
-	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x61, 0x78, 0x46, 0x61, 0x69, 0x6c, 0x75, 0x72, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x19, 0x65, 0x6e,
-	0x68, 0x61, 0x31, 0x42, 0x1b, 0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x43, 0x6f,
+	0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74,
-	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x69, 0x76, 0x65, 0x5f, 0x35, 0x78, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x17, 0x65,
-	0x50, 0x01, 0x5a, 0x45, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
+	0x6e, 0x66, 0x6f, 0x72, 0x63, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74,
-	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f,
+	0x69, 0x76, 0x65, 0x35, 0x78, 0x78, 0x42, 0xa3, 0x02, 0x0a, 0x22, 0x63, 0x6f, 0x6d, 0x2e, 0x68,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e,
-	0x65, 0x73, 0x68, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73,
+	0x6d, 0x65, 0x73, 0x68, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x42, 0x1b, 0x55,
-	0x68, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa,
+	0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72,
-	0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x45, 0x67, 0x69,
-	0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73, 0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
-	0xca, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e,
+	0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d,
-	0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62, 0x6d, 0x65, 0x73, 0x68, 0x2f, 0x76, 0x31,
-	0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6d, 0x65, 0x73, 0x68, 0x76, 0x31, 0x61, 0x6c, 0x70,
-	0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x68, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x4d, 0xaa, 0x02, 0x1e, 0x48, 0x61, 0x73, 0x68,
-	0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
+	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x4d, 0x65, 0x73,
-	0x21, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73,
+	0x68, 0x2e, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xca, 0x02, 0x1e, 0x48, 0x61, 0x73,
-	0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65, 0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d, 0x65,
-	0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0xe2, 0x02, 0x2a, 0x48, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x4d,
+	0x65, 0x73, 0x68, 0x5c, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x5c, 0x47, 0x50, 0x42,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x21, 0x48, 0x61, 0x73, 0x68, 0x69,
+	0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a, 0x4d, 0x65,
+	0x73, 0x68, 0x3a, 0x3a, 0x56, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -571,6 +580,7 @@ var file_pbmesh_v1alpha1_upstreams_configuration_proto_goTypes = []interface{}{
 	(*durationpb.Duration)(nil),       // 8: google.protobuf.Duration
 	(BalanceConnections)(0),           // 9: hashicorp.consul.mesh.v1alpha1.BalanceConnections
 	(MeshGatewayMode)(0),              // 10: hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
+	(*wrapperspb.UInt32Value)(nil),    // 11: google.protobuf.UInt32Value
 }
 var file_pbmesh_v1alpha1_upstreams_configuration_proto_depIdxs = []int32{
 	5,  // 0: hashicorp.consul.mesh.v1alpha1.UpstreamsConfiguration.workloads:type_name -> hashicorp.consul.catalog.v1alpha1.WorkloadSelector
@@ -584,12 +594,15 @@ var file_pbmesh_v1alpha1_upstreams_configuration_proto_depIdxs = []int32{
 	4,  // 8: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.passive_health_check:type_name -> hashicorp.consul.mesh.v1alpha1.PassiveHealthCheck
 	9,  // 9: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.balance_outbound_connections:type_name -> hashicorp.consul.mesh.v1alpha1.BalanceConnections
 	10, // 10: hashicorp.consul.mesh.v1alpha1.UpstreamConfig.mesh_gateway_mode:type_name -> hashicorp.consul.mesh.v1alpha1.MeshGatewayMode
-	8,  // 11: hashicorp.consul.mesh.v1alpha1.PassiveHealthCheck.interval:type_name -> google.protobuf.Duration
+	11, // 11: hashicorp.consul.mesh.v1alpha1.UpstreamLimits.max_connections:type_name -> google.protobuf.UInt32Value
-	12, // [12:12] is the sub-list for method output_type
+	11, // 12: hashicorp.consul.mesh.v1alpha1.UpstreamLimits.max_pending_requests:type_name -> google.protobuf.UInt32Value
-	12, // [12:12] is the sub-list for method input_type
+	11, // 13: hashicorp.consul.mesh.v1alpha1.UpstreamLimits.max_concurrent_requests:type_name -> google.protobuf.UInt32Value
-	12, // [12:12] is the sub-list for extension type_name
+	8,  // 14: hashicorp.consul.mesh.v1alpha1.PassiveHealthCheck.interval:type_name -> google.protobuf.Duration
-	12, // [12:12] is the sub-list for extension extendee
+	15, // [15:15] is the sub-list for method output_type
-	0,  // [0:12] is the sub-list for field type_name
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
 }
 
 func init() { file_pbmesh_v1alpha1_upstreams_configuration_proto_init() }

proto-public/pbmesh/v1alpha1/upstreams_configuration.proto

@@ -6,6 +6,7 @@ syntax = "proto3";
 package hashicorp.consul.mesh.v1alpha1;
 
 import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
 import "pbcatalog/v1alpha1/protocol.proto";
 import "pbcatalog/v1alpha1/selector.proto";
 import "pbmesh/v1alpha1/connection.proto";
@@ -73,18 +74,18 @@ message UpstreamConfig {
 message UpstreamLimits {
   // max_connections is the maximum number of connections the local proxy can
   // make to the upstream service.
-  int32 max_connections = 1;
+  google.protobuf.UInt32Value max_connections = 1;
 
   // max_pending_requests is the maximum number of requests that will be queued
   // waiting for an available connection. This is mostly applicable to HTTP/1.1
   // clusters since all HTTP/2 requests are streamed over a single
   // connection.
-  int32 max_pending_requests = 2;
+  google.protobuf.UInt32Value max_pending_requests = 2;
 
   // max_concurrent_requests is the maximum number of in-flight requests that will be allowed
   // to the upstream cluster at a point in time. This is mostly applicable to HTTP/2
   // clusters since all HTTP/1.1 requests are limited by MaxConnections.
-  int32 max_concurrent_requests = 3;
+  google.protobuf.UInt32Value max_concurrent_requests = 3;
 }
 
 message PassiveHealthCheck {