Compute V1 Client - Class BackendServiceTlsSettings (2.16.0)

Reference documentation and code samples for the Compute V1 Client class BackendServiceTlsSettings.

Generated from protobuf message google.cloud.compute.v1.BackendServiceTlsSettings

Namespace

Google \ Cloud \ Compute \ V1

Methods

__construct

Constructor.

Parameters
Name Description
data array

Optional. Data for populating the Message object.
↳ authentication_config string

Reference to the BackendAuthenticationConfig resource from the networksecurity.googleapis.com namespace. Can be used in authenticating TLS connections to the backend, as specified by the authenticationMode field. Can only be specified if authenticationMode is not NONE.
↳ identity string

Assigns the Managed Identity for the BackendService Workload. Use this property to configure the load balancer back-end to use certificates and roots of trust provisioned by the Managed Workload Identity system. The identity property is the fully-specified SPIFFE ID to use in the SVID presented by the Load Balancer Workload. The SPIFFE ID must be a resource starting with the trustDomain property value, followed by the path to the Managed Workload Identity. Supported SPIFFE ID format: - //<trust_domain>/ns/
↳ sni string

Server Name Indication - see RFC3546 section 3.1. If set, the load balancer sends this string as the SNI hostname in the TLS connection to the backend, and requires that this string match a Subject Alternative Name (SAN) in the backend's server certificate. With a Regional Internet NEG backend, if the SNI is specified here, the load balancer uses it regardless of whether the Regional Internet NEG is specified with FQDN or IP address and port. When both sni and subjectAltNames[] are specified, the load balancer matches the backend certificate's SAN only to subjectAltNames[].
↳ subject_alt_names array<BackendServiceTlsSettingsSubjectAltName>

A list of Subject Alternative Names (SANs) that the Load Balancer verifies during a TLS handshake with the backend. When the server presents its X.509 certificate to the Load Balancer, the Load Balancer inspects the certificate's SAN field, and requires that at least one SAN match one of the subjectAltNames in the list. This field is limited to 5 entries. When both sni and subjectAltNames[] are specified, the load balancer matches the backend certificate's SAN only to subjectAltNames[].

getAuthenticationConfig

Reference to the BackendAuthenticationConfig resource from the networksecurity.googleapis.com namespace. Can be used in authenticating TLS connections to the backend, as specified by the authenticationMode field. Can only be specified if authenticationMode is not NONE.

Returns
Type Description
string

hasAuthenticationConfig

clearAuthenticationConfig

setAuthenticationConfig

Reference to the BackendAuthenticationConfig resource from the networksecurity.googleapis.com namespace. Can be used in authenticating TLS connections to the backend, as specified by the authenticationMode field. Can only be specified if authenticationMode is not NONE.

Parameter
Name Description
var string
Returns
Type Description
$this

getIdentity

Assigns the Managed Identity for the BackendService Workload.

Use this property to configure the load balancer back-end to use certificates and roots of trust provisioned by the Managed Workload Identity system. The identity property is the fully-specified SPIFFE ID to use in the SVID presented by the Load Balancer Workload. The SPIFFE ID must be a resource starting with the trustDomain property value, followed by the path to the Managed Workload Identity. Supported SPIFFE ID format:

  • //<trust_domain>/ns/
  • If you set the identity property, you cannot manually set the following fields:
    • tlsSettings.sni
      • tlsSettings.subjectAltNames
      • tlsSettings.authenticationConfig When defining a identity for a RegionBackendServices, the corresponding Workload Identity Pool must have a ca_pool configured in the same region. The system will set up a read-onlytlsSettings.authenticationConfig for the Managed Identity.
Returns
Type Description
string

hasIdentity

clearIdentity

setIdentity

Assigns the Managed Identity for the BackendService Workload.

Use this property to configure the load balancer back-end to use certificates and roots of trust provisioned by the Managed Workload Identity system. The identity property is the fully-specified SPIFFE ID to use in the SVID presented by the Load Balancer Workload. The SPIFFE ID must be a resource starting with the trustDomain property value, followed by the path to the Managed Workload Identity. Supported SPIFFE ID format:

  • //<trust_domain>/ns/
  • If you set the identity property, you cannot manually set the following fields:
    • tlsSettings.sni
      • tlsSettings.subjectAltNames
      • tlsSettings.authenticationConfig When defining a identity for a RegionBackendServices, the corresponding Workload Identity Pool must have a ca_pool configured in the same region. The system will set up a read-onlytlsSettings.authenticationConfig for the Managed Identity.
Parameter
Name Description
var string
Returns
Type Description
$this

getSni

Server Name Indication - see RFC3546 section 3.1. If set, the load balancer sends this string as the SNI hostname in the TLS connection to the backend, and requires that this string match a Subject Alternative Name (SAN) in the backend's server certificate. With a Regional Internet NEG backend, if the SNI is specified here, the load balancer uses it regardless of whether the Regional Internet NEG is specified with FQDN or IP address and port. When both sni and subjectAltNames[] are specified, the load balancer matches the backend certificate's SAN only to subjectAltNames[].

Returns
Type Description
string

hasSni

clearSni

setSni

Server Name Indication - see RFC3546 section 3.1. If set, the load balancer sends this string as the SNI hostname in the TLS connection to the backend, and requires that this string match a Subject Alternative Name (SAN) in the backend's server certificate. With a Regional Internet NEG backend, if the SNI is specified here, the load balancer uses it regardless of whether the Regional Internet NEG is specified with FQDN or IP address and port. When both sni and subjectAltNames[] are specified, the load balancer matches the backend certificate's SAN only to subjectAltNames[].

Parameter
Name Description
var string
Returns
Type Description
$this

getSubjectAltNames

A list of Subject Alternative Names (SANs) that the Load Balancer verifies during a TLS handshake with the backend. When the server presents its X.509 certificate to the Load Balancer, the Load Balancer inspects the certificate's SAN field, and requires that at least one SAN match one of the subjectAltNames in the list. This field is limited to 5 entries. When both sni and subjectAltNames[] are specified, the load balancer matches the backend certificate's SAN only to subjectAltNames[].

Returns
Type Description
Google\Protobuf\RepeatedField<BackendServiceTlsSettingsSubjectAltName>

setSubjectAltNames

A list of Subject Alternative Names (SANs) that the Load Balancer verifies during a TLS handshake with the backend. When the server presents its X.509 certificate to the Load Balancer, the Load Balancer inspects the certificate's SAN field, and requires that at least one SAN match one of the subjectAltNames in the list. This field is limited to 5 entries. When both sni and subjectAltNames[] are specified, the load balancer matches the backend certificate's SAN only to subjectAltNames[].

Parameter
Name Description
var array<BackendServiceTlsSettingsSubjectAltName>
Returns
Type Description
$this