# Copyright 2021 IBM Corporation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.apiVersion: kustomize.config.k8s.io/v1beta1
#
# Since this modify the istio configmap, need to restart istiod with the
# following command:
#     kubectl rollout restart deployment/istiod -n istio-system
#
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    install.operator.istio.io/owning-resource: unknown
    istio.io/rev: default
    operator.istio.io/component: Pilot
    release: istio
  name: istio
  namespace: istio-system
data:
  mesh: |-
    accessLogFile: /dev/stdout
    defaultConfig:
      discoveryAddress: istiod.istio-system.svc:15012
      proxyMetadata: {}
      tracing:
        zipkin:
          address: zipkin.istio-system:9411
    enablePrometheusMerge: true
    rootNamespace: istio-system
    trustDomain: cluster.local
    extensionProviders:
    - name: "mlx-authz-http"
      envoyExtAuthzHttp:
        service: "mlx-ui.kubeflow.svc.cluster.local"
        port: "80"
        pathPrefix: "/session-validation"
        includeHeadersInCheck: ["cookie", "x-ext-authz"]
        headersToUpstreamOnAllow: ["kubeflow-userid"]
        headersToDownstreamOnDeny: ["content-type", "set-cookie"]
  meshNetworks: 'networks: {}'
