$defs:
  client_config:
    description: ClientConfig contains TLS configurations that are specific to client connections in addition to the common configurations. This should be used by components configuring TLS client connections.
    type: object
    properties:
      insecure:
        description: In gRPC and HTTP when set to true, this is used to disable the client transport security. See https://godoc.org/google.golang.org/grpc#WithInsecure for gRPC. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional, default false)
        type: boolean
      insecure_skip_verify:
        description: InsecureSkipVerify will enable TLS but not verify the certificate.
        type: boolean
      server_name_override:
        description: ServerName requested by client for virtual hosting. This sets the ServerName in the TLSConfig. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional)
        type: string
    allOf:
      - $ref: config
  config:
    description: 'Config exposes the common client and server TLS configurations. Note: Since there isn''t anything specific to a server connection. Components with server connections should use Config.'
    type: object
    properties:
      ca_file:
        description: Path to the CA cert. For a client this verifies the server certificate. For a server this verifies client certificates. If empty uses system root CA. (optional)
        type: string
      ca_pem:
        description: In memory PEM encoded cert. (optional)
        $ref: /config/configopaque.string
      cert_file:
        description: Path to the TLS cert to use for TLS required connections. (optional)
        type: string
      cert_pem:
        description: In memory PEM encoded TLS cert to use for TLS required connections. (optional)
        $ref: /config/configopaque.string
      cipher_suites:
        description: CipherSuites is a list of TLS cipher suites that the TLS transport can use. If left blank, a safe default list is used. See https://go.dev/src/crypto/tls/cipher_suites.go for a list of supported cipher suites.
        type: array
        items:
          type: string
      curve_preferences:
        description: contains the elliptic curves that will be used in an ECDHE handshake, in preference order Defaults to empty list and "crypto/tls" defaults are used, internally.
        type: array
        items:
          type: string
      include_system_ca_certs_pool:
        description: If true, load system CA certificates pool in addition to the certificates configured in this struct.
        type: boolean
      key_file:
        description: Path to the TLS key to use for TLS required connections. (optional)
        type: string
      key_pem:
        description: In memory PEM encoded TLS key to use for TLS required connections. (optional)
        $ref: /config/configopaque.string
      max_version:
        description: MaxVersion sets the maximum TLS version that is acceptable. If not set, refer to crypto/tls for defaults. (optional)
        type: string
      min_version:
        description: MinVersion sets the minimum TLS version that is acceptable. If not set, TLS 1.2 will be used. (optional)
        type: string
      reload_interval:
        description: ReloadInterval specifies the duration after which the certificate will be reloaded If not set, it will never be reloaded (optional)
        type: string
        x-customType: time.Duration
        format: duration
      tpm:
        description: Trusted platform module configuration
        $ref: tpm_config
  server_config:
    description: ServerConfig contains TLS configurations that are specific to server connections in addition to the common configurations. This should be used by components configuring TLS server connections.
    type: object
    properties:
      client_ca_file:
        description: Path to the TLS cert to use by the server to verify a client certificate. (optional) This sets the ClientCAs and ClientAuth to RequireAndVerifyClientCert in the TLSConfig. Please refer to https://godoc.org/crypto/tls#Config for more information. (optional)
        type: string
      client_ca_file_reload:
        description: Reload the ClientCAs file when it is modified (optional, default false)
        type: boolean
    allOf:
      - $ref: config
  tpm_config:
    description: TPMConfig defines trusted platform module configuration for storing TLS keys.
    type: object
    properties:
      auth:
        type: string
      enabled:
        type: boolean
      owner_auth:
        type: string
      path:
        description: The path to the TPM device or Unix domain socket. For instance /dev/tpm0 or /dev/tpmrm0.
        type: string
