apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy
  labels:
    app: authorino
data:
  envoy.yaml: |
    static_resources:
      listeners:
      - address:
          socket_address:
            address: 0.0.0.0
            port_value: 8000
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: local
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ['*']
                  typed_per_filter_config:
                    envoy.filters.http.ext_authz:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
                      check_settings:
                        context_extensions:
                          virtual_host: local_service
                  routes:
                  - match:
                      prefix: "/direct"
                    direct_response:
                      status: 200
                      body:
                        inline_string: 'direct'
                  - match: { prefix: /web }
                    route:
                      cluster: talker-web
                    typed_per_filter_config:
                      envoy.filters.http.ext_authz:
                        "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
                        disabled: true
                  - match: { prefix: / }
                    route:
                      cluster: talker-api
                  rate_limits:
                  - actions:
                      - metadata:
                          metadata_key:
                            key: "envoy.filters.http.ext_authz"
                            path:
                            - key: ext_auth_data
                            - key: username
                          descriptor_key: user_id
              http_filters:
              - name: envoy.filters.http.ext_authz
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                  transport_api_version: V3
                  failure_mode_allow: false
                  include_peer_certificate: true
                  grpc_service:
                    envoy_grpc:
                      cluster_name: external_auth
                    timeout: 1s
              - name: envoy.filters.http.ratelimit
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
                  domain: "talker-api"
                  failure_mode_deny: false
                  timeout: 3s
                  rate_limit_service:
                    transport_api_version: V3
                    grpc_service:
                      envoy_grpc:
                        cluster_name: rate_limit
              - name: envoy.filters.http.router
                typed_config: {}
              use_remote_address: true
      clusters:
      - name: external_auth
        connect_timeout: 0.25s
        type: strict_dns
        lb_policy: round_robin
        http2_protocol_options: {}
        load_assignment:
          cluster_name: external_auth
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: authorino-authorization
                    port_value: 50051
      - name: rate_limit
        connect_timeout: 1s
        type: STRICT_DNS
        lb_policy: round_robin
        http2_protocol_options: {}
        load_assignment:
          cluster_name: rale_limit
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: limitador
                    port_value: 8081
      - name: talker-api
        connect_timeout: 0.25s
        type: strict_dns
        lb_policy: round_robin
        load_assignment:
          cluster_name: talker-api
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: talker-api
                    port_value: 3000
      - name: talker-web
        connect_timeout: 0.25s
        type: strict_dns
        lb_policy: round_robin
        load_assignment:
          cluster_name: talker-web
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: talker-web
                    port_value: 8888
    admin:
      access_log_path: "/tmp/admin_access.log"
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 8001

