# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-config
  namespace: apigee
data:
  config.yaml: |
    admin:
      access_log_path: /tmp/envoy_admin.log
      address:
        socket_address:
          address: 127.0.0.1
          port_value: 9000
      
    static_resources:
      listeners:
      - address:
          socket_address: { address: 0.0.0.0, port_value: 8080 }
      
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:  
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: ingress_http
              route_config:
                virtual_hosts:
                - name: default
                  domains: "*"
                  routes:
                  - match: { prefix: / }
                    route:
                      cluster: target
                    typed_per_filter_config:
                      envoy.filters.http.dynamic_forward_proxy:
                        "@type": type.googleapis.com/envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig

              http_filters:
      
              - name: envoy.filters.http.dynamic_forward_proxy
                typed_config:
                  "@type": type.googleapis.com/envoy.config.filter.http.dynamic_forward_proxy.v2alpha.FilterConfig
                  dns_cache_config:
                    name: dynamic_forward_proxy_cache_config
                    dns_lookup_family: V4_ONLY
      
              # evaluate JWT tokens, allow_missing allows API Key also
              - name: envoy.filters.http.jwt_authn
                typed_config: 
                  "@type": type.googleapis.com/envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication
                  providers:
                    apigee:
                      issuer: testserver
                      audiences:
                      - remote-service-client
                      remote_jwks:
                        http_uri:
                          uri: https://mock-apigee.apigee.svc.cluster.local:6000/certs
                          cluster: apigee-remote-service-envoy
                          timeout: 5s
                        cache_duration:
                          seconds: 300
                      payload_in_metadata: apigee
                  rules:
                  - match:
                      prefix: /
                    requires:
                      requires_any:
                        requirements:
                        - provider_name: apigee
                        - allow_missing: {}
      
              # evaluate Apigee rules
              - name: envoy.filters.http.ext_authz
                typed_config:
                  "@type": type.googleapis.com/envoy.config.filter.http.ext_authz.v2.ExtAuthz
                  grpc_service:
                    envoy_grpc:
                      cluster_name: apigee-remote-service-envoy
                    timeout: 5s                
                  metadata_context_namespaces:
                  - envoy.filters.http.jwt_authn
      
              # evaluate RBAC (necessary for Apigee config: allow_unauthorized == true)
              - name: envoy.filters.http.rbac
                typed_config:
                  "@type": type.googleapis.com/envoy.config.filter.http.rbac.v2.RBAC
                  rules:
                    action: ALLOW
                    policies:
                      apigee-connector:
                        principals:
                        - any: true
                        permissions:
                        - header: { "name": "X-Apigee-Authorized" }
      
              - name: envoy.filters.http.router
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
      
              access_log: 
      
              # collect Apigee analytics
              - name: envoy.access_loggers.http_grpc
                typed_config:
                  "@type": type.googleapis.com/envoy.config.accesslog.v2.HttpGrpcAccessLogConfig
                  common_config:
                    grpc_service:
                      envoy_grpc:
                        cluster_name: apigee-remote-service-envoy
                    log_name: apigee-remote-service-envoy
                  additional_request_headers_to_log:
                  - :authority # default target header
                  # context headers
                  - x-apigee-accesstoken
                  - x-apigee-api
                  - x-apigee-apiproducts
                  - x-apigee-application
                  - x-apigee-clientid
                  - x-apigee-developeremail
      
      clusters:
        
      # define cluster for Apigee remote service
      - name: apigee-remote-service-envoy
        type: STRICT_DNS
        http2_protocol_options: {}
        load_assignment:
          cluster_name: apigee-remote-service-envoy
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: apigee-remote-service-envoy.apigee.svc.cluster.local
                    port_value: 5000
        common_lb_config:
          healthy_panic_threshold:
            value: 50.0
        health_checks:
          - timeout: 1s
            interval: 10s
            interval_jitter: 1s
            no_traffic_interval: 5s
            unhealthy_threshold: 1
            healthy_threshold: 3
            grpc_health_check: {}
        connect_timeout: 2s
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
            sni: apigee-remote-service-envoy.apigee.svc.cluster.local
    
        # define cluster for target
      - name: target
        connect_timeout: 2s
        type: LOGICAL_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: target
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: localhost
                    port_value: 6001