.. _envoy_v3_api_file_envoy/extensions/transport_sockets/alts/v3/alts.proto:

ALTS
====


This documentation is for the Envoy v3 API.

As of Envoy v1.18 the v2 API has been removed and is no longer supported.

If you are upgrading from v2 API config you may wish to view the v2 API documentation:

    :ref:`config/transport_socket/alts/v2alpha/alts.proto <v1.17.2:envoy_api_file_envoy/config/transport_socket/alts/v2alpha/alts.proto>`



.. _extension_envoy.transport_sockets.alts:

This extension may be referenced by the qualified name ``envoy.transport_sockets.alts``

.. note::
  

  This extension is intended to be robust against both untrusted downstream and upstream traffic.

.. tip::
  This extension extends and can be used with the following extension categories:


  - :ref:`envoy.transport_sockets.downstream <extension_category_envoy.transport_sockets.downstream>`

  - :ref:`envoy.transport_sockets.upstream <extension_category_envoy.transport_sockets.upstream>`


.. _envoy_v3_api_msg_extensions.transport_sockets.alts.v3.Alts:

extensions.transport_sockets.alts.v3.Alts
-----------------------------------------

:repo:`[extensions.transport_sockets.alts.v3.Alts proto] <api/envoy/extensions/transport_sockets/alts/v3/alts.proto#L18>`

Configuration for ALTS transport socket. This provides Google's ALTS protocol to Envoy.
https://cloud.google.com/security/encryption-in-transit/application-layer-transport-security/

.. code-block:: json

  {
    "handshaker_service": "...",
    "peer_service_accounts": []
  }

.. _envoy_v3_api_field_extensions.transport_sockets.alts.v3.Alts.handshaker_service:

handshaker_service
  (`string <https://developers.google.com/protocol-buffers/docs/proto#scalar>`_, *REQUIRED*) The location of a handshaker service, this is usually 169.254.169.254:8080
  on GCE.
  
  
.. _envoy_v3_api_field_extensions.transport_sockets.alts.v3.Alts.peer_service_accounts:

peer_service_accounts
  (**repeated** `string <https://developers.google.com/protocol-buffers/docs/proto#scalar>`_) The acceptable service accounts from peer, peers not in the list will be rejected in the
  handshake validation step. If empty, no validation will be performed.