apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-conf
  namespace: aqua
data:
  envoy.yaml: |
    static_resources:
      listeners:
      - address:
          socket_address:
            address: 0.0.0.0
            port_value: 8443
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              stream_idle_timeout: 0s
              access_log:
              - name: envoy.file_access_log
                config:
                  path: "/dev/stdout"
              codec_type: AUTO
              stat_prefix: ingress_https
              route_config:
                name: local_route
                virtual_hosts:
                - name: https
                  domains:
                  - "*"
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: aqua-gateway
                      timeout: 0s
              http_filters:
              - name: envoy.health_check
                config:
                  pass_through_mode: false
                  headers:
                  - name: ":path"
                    exact_match: "/healthz"
                  - name: "x-envoy-livenessprobe"
                    exact_match: "healthz"
              - name: envoy.router
                config: {}
          tls_context:
            common_tls_context:
    # Used with self-signed certs and AQUA_TLS_VERIFY=true on the Enforcer and if the below chain does not include a root cert
    #         validation_context:
    #           trusted_ca:
    #             filename: "/etc/ssl/envoy/ca.crt
              alpn_protocols: "h2,http/1.1"
              tls_certificates:
              - certificate_chain:
    #cert location for communication to Enforcer
                  filename: "/etc/ssl/envoy/tls.crt"
                private_key:
    #private_key location  for communication to Enforcer
                  filename: "/etc/ssl/envoy/tls.key"
      clusters:
      - name: aqua-gateway
        connect_timeout: 180s
        type: STRICT_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        http2_protocol_options: { hpack_table_size: 4294967, max_concurrent_streams: 2147483647}
        circuit_breakers:
            thresholds:
                max_pending_requests: 2147483647
                max_requests: 2147483647
        load_assignment:
          cluster_name: aqua-gateway
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
    # This should match format <headless_SVC_name.namespace.svc.cluster.local> (Default: aqua-gateway-headless.aqua.svc.cluster.local)
                    address: aqua-gateway.aqua.svc.cluster.local
                    port_value: 8443
        transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
                "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    # This should match the deployment name/app name (Default: aqua-gateway)
                sni: aqua-gateway

    admin:
      access_log_path: "/dev/stdout"
      address:
        socket_address:
          address: 127.0.0.1
          port_value: 8090