# Copyright 2021 The Kubermatic Kubernetes Platform contributors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: alertmanager-proxy-config
data:
  envoy.yaml: |
    admin:
      access_log_path: /tmp/admin_access.log
      address:
        socket_address:
          protocol: TCP
          address: 127.0.0.1
          port_value: 9901
      
    static_resources:
      listeners:

      ### authorization and path rewiting proxy ###
      - name: listener_http
        address:
          socket_address:
            protocol: TCP
            address: 0.0.0.0
            port_value: 8080
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:  
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: ingress_http
              access_log:
              - name: envoy.access_loggers.file
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
                  path: /dev/stdout
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:

                  # redirect if the path contains only cluster ID without slash (append slash at the end)
                  - match:
                      safe_regex:
                        google_re2: {}
                        regex: '^/([[:alnum:]]+)$'
                    redirect:
                      regex_rewrite:
                        pattern:
                          google_re2: {}
                          regex: '^/([[:alnum:]]+)$'
                        substitution: '/\1/'

                  # strip tenant ID from the path
                  - match:
                      safe_regex:
                        google_re2: {}
                        regex: '^/(.+?)/(.*)'
                    route:
                      regex_rewrite:
                        pattern:
                          google_re2: {}
                          regex: '^/(.+?)/(.*)'
                        substitution: '/api/prom/alertmanager/\2'
                      cluster: service_backend

              http_filters:
              - name: envoy.filters.http.ext_authz
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                  transport_api_version: V3
                  grpc_service:
                    envoy_grpc:
                      cluster_name: ext-authz
                    timeout: 2s
                  status_on_error:
                    code: ServiceUnavailable
              - name: envoy.filters.http.router

      ### limited access to envoy stats and health ###
      - name: service_stats
        address:
          socket_address:
            protocol: TCP
            address: 0.0.0.0
            port_value: 9902
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: service_stats
              route_config:
                name: local_route
                virtual_hosts:
                - name: stats_backend
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/stats"
                    route:
                      cluster: service_stats
                  - match:
                      prefix: "/ready"
                    route:
                      cluster: service_stats
              http_filters:
              - name: envoy.filters.http.router

      clusters:
      - name: service_backend
        connect_timeout: 2s
        type: STRICT_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: service_backend
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: {{ .Values.alertmanagerProxy.backendAddress }}
                    port_value: {{ .Values.alertmanagerProxy.backendPort }}

      - name: ext-authz
        type: STRICT_DNS
        connect_timeout: 2s
        http2_protocol_options: {}
        load_assignment:
          cluster_name: ext-authz
          endpoints:
            - lb_endpoints:
                - endpoint:
                    address:
                      socket_address:
                        address: alertmanager-authz-server
                        port_value: 50051

      - name: service_stats
        connect_timeout: 0.1s
        type: STATIC
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: service_stats
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: 127.0.0.1
                    port_value: 9901
