apiVersion: v1
kind: ConfigMap
metadata:
  name: test1-id
  namespace: default
  labels:
    app: envoy-control-plane
    version: v1
data:
  test1-id: |-
    kubernetes:
    - cluster_name: local_service1
      port: 8001
      selector:
        app: test-001
    - cluster_name: test-envoy-service
      port: 8001
      selector:
        app: test-002
    endpoints:
    - cluster_name: local_service1
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: 127.0.0.1
                port_value: 18000
        - endpoint:
            address:
              socket_address:
                address: 127.0.0.2
                port_value: 18000
    secrets:
    - name: server_cert
      tls_certificate:
        certificate_chain:
          inline_string: |
            -----BEGIN CERTIFICATE-----
            MIIDYjCCAkoCCQDArpUA7DFQcDANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJH
            QjEPMA0GA1UECAwGTG9uZG9uMQ8wDQYDVQQHDAZMb25kb24xGDAWBgNVBAoMD0ds
            b2JhbCBTZWN1cml0eTEWMBQGA1UECwwNSVQgRGVwYXJ0bWVudDEQMA4GA1UEAwwH
            Ki5sb2NhbDAeFw0yMTA4MjUxNTQyMDNaFw0zMTA4MjMxNTQyMDNaMHMxCzAJBgNV
            BAYTAkdCMQ8wDQYDVQQIDAZMb25kb24xDzANBgNVBAcMBkxvbmRvbjEYMBYGA1UE
            CgwPR2xvYmFsIFNlY3VyaXR5MRYwFAYDVQQLDA1JVCBEZXBhcnRtZW50MRAwDgYD
            VQQDDAcqLmxvY2FsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5W7n
            xqdzIyBIhosaAemJkqlkuRS5juSHBw0volwu/SKwnksDbB5QAKjC4Ga41MtuR0VN
            ae/yCv4XH+391zaZnyVSuKjxYyzoccbdHWz3JiGJzQnmNViV+McXoe//Kv4b5LD8
            +/2qmei+G/Ulq3dZ58TENVqBy3SumB/i7wq/p//e2yzt3W89e1AwxF9/pWLTmqnB
            /TPoXCinKCli17zIRzwyVrSwd/DWKK2a26A3MTZGfGB5g7Fai38vc9RO2plB09gZ
            vzV+yYgZyvC7Zc6SFtUHWRLKbqgQ0A9osDXBJ+4ChrLDx9NfF+3qvCRXGlOYT8bR
            HndVzPQQHPMKhsYtYQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRwuiv51GxEVHb
            aSmHt/yBlM19FUEg+3z78NkL+gHMssIj+ANcSEzvXglaihMTAIKxYiRK7Vh88SW4
            F3XNzlEmQOfOfvg3uyz+eQZjr+XkGSzYNoK2dmgS6JjH70SCsCu4qe5MeBPv24MK
            ILbudQijVmCLph34W/v5VtkAC+OrcRZwNA6p1osJxU0kbj/Yg9H2JkvNG/QZM3Lb
            rW9Hi6c57L6tTGUKc/7onu/0SnFcuJKESVG/sKiL5K4pMTm5gfDxGh69awFK9oCk
            a0RHlVTdZsFAwOi9yIQaKwvEtOniPw5V5b1opVVKPhg/fHH4wK00VLdLsagaxr/e
            BcdcEHDp
            -----END CERTIFICATE-----
        private_key:
          inline_string: |
            -----BEGIN PRIVATE KEY-----
            MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDlbufGp3MjIEiG
            ixoB6YmSqWS5FLmO5IcHDS+iXC79IrCeSwNsHlAAqMLgZrjUy25HRU1p7/IK/hcf
            7f3XNpmfJVK4qPFjLOhxxt0dbPcmIYnNCeY1WJX4xxeh7/8q/hvksPz7/aqZ6L4b
            9SWrd1nnxMQ1WoHLdK6YH+LvCr+n/97bLO3dbz17UDDEX3+lYtOaqcH9M+hcKKco
            KWLXvMhHPDJWtLB38NYorZrboDcxNkZ8YHmDsVqLfy9z1E7amUHT2Bm/NX7JiBnK
            8LtlzpIW1QdZEspuqBDQD2iwNcEn7gKGssPH018X7eq8JFcaU5hPxtEed1XM9BAc
            8wqGxi1hAgMBAAECggEAPGZPBCAvEm88SJc0GI7HleGcT5EiLHkDBxs0kBSelitc
            vb9Xvk3Yl+PVsce5HuQTOxYGhD4TxUsRAWng6phIJvpnZY+sRISdCN7mdQmrotEv
            etgBT8fra1vWX95TmZjd9P2XDCvCjtQTwD5wVUyNUZOeZ8FU7B/ims/CKVX2EJ6u
            9zLIGs3QcGa/wbTR3oIo4IJtZLWMWEVI2rBhD9XC25RoSysDH8Il1tt2DOwTsh0/
            utLMkVyeZagUcv8DhbxHlNQnobpUA6AklkKa47aBc6zESxkcrRH7YF/KiusMjIJK
            Fmb3DR2iNvfWvcqUSsA0hWRYdbfdquBvnz43GtSvwQKBgQD7Y5s9W+bIjnepJqjF
            PhoHdzUsydKuZbP/yQd0iHOGJ/kxcI4qs64xLBwcnaSVZkIEdxA9w/Uz5wAHfuIJ
            yc3smE0q2MucHRPChNMc+m4/JIzUfniO8LM7Y7XFe92Ik/DD6fDZdbS7VfRS4oB3
            JmCp5u7ByPkRpTbTfDMPGaBXmQKBgQDppDSe/Qu1x2RUvqF4ucDnwcW362qWoPMl
            WLvg+2UN7ott/ooj+Qj5oyZsan67PLP7ZAvTDLY0WUpnyeyUQn1aw/tl/dfpvLq6
            rriCrrhXL/mlkYi94rnvXp9czW8u7NOlEsNoP+sLBXFLrWc+2hQ1eYYcoLtdBwyv
            2YmQ51eBCQKBgQDLh4V0VCexUMdIx+f0aachTD5dGLneQLFO8i97Bc6iW1LB2GMB
            55+saA4KjQdnffcNLmiT2Ud40hmP+AaB7kUuvNAdVJDkwBXzcx6JY6hGrwzmLc7l
            y7MQ7lWIohRmM4DG3W0GYuoEkj7RrFheH1A7vqCnfFNLGfwdlXyxSQosYQKBgH94
            o20KylTHEKpbx2VCk0jeo60Qt/qunXoGy5qYDi5ns5KziVLPEGKC7PfBspsdJ2VE
            1F61VMOC4+F0far2C8Z1nreqox5XZdlsciZ6hQCsoBwBJwXSqXc7vN65BqwnceFi
            N1KtbON6eLG9TdMw0E3Mm6sK1q6OphFbMn7oeQlhAoGBAMi/Hg9uKC0DWZ20gccD
            NLjPD+ROCb8r9Rx3Jy2WrLFdT3NDg21rA4Zd9sQwZr+oTBNeehCwR/QwyWif3FDX
            zZOiDMuLsbLgOnesOBqc0l2LST5rCEoCjfjf8L9Qzr7llAdaFE6Bzg3bzcO7CNK/
            D/b3snxxt5ZnU4Y1HKAtKrEv
            -----END PRIVATE KEY-----
    listeners:
    - name: listener_0
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 8000
      traffic_direction: INBOUND
      filter_chains:
      - filters:
        - name: envoy.filters.network.http_connection_manager
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
            stat_prefix: ingress_http
            codec_type: AUTO
            stream_error_on_invalid_http_message: true
            tracing: {}
            access_log:
            - name: envoy.access_loggers.file
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
                path: /dev/stdout
                log_format:
                  json_format:
                    protocol: "%PROTOCOL%"
                    duration: "%DURATION%"
                    response_code: "%RESPONSE_CODE%"
                    response_flags: "%RESPONSE_FLAGS%"
                    x_request_id: "%REQ(X-REQUEST-ID)%"
            rds:
              route_config_name: test
              config_source:
                resource_api_version: V3
                api_config_source:
                  api_type: GRPC
                  transport_api_version: V3
                  grpc_services:
                  - envoy_grpc:
                      cluster_name: xds_cluster
            http_filters:
            - name: envoy.lua
              typed_config:
                "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
                inline_code: |
                  function stringSplit(inputstr, sep)
                    if sep == nil then
                      sep = "%s"
                    end
                    local t={}
                    for str in string.gmatch(inputstr, "([^"..sep.."]+)") do
                      table.insert(t, str)
                    end
                    return t
                  end
                  function envoy_on_request(request_handle)
                    -- cookies to save in metadata
                    local cookiesArray = {"CID"}
                    local cookie = request_handle:headers():get("cookie")
                    local dynamicMetadata = request_handle:streamInfo():dynamicMetadata()

                    if cookie ~= nil then
                      local splitCookieString = stringSplit(cookie, ";")
                      for i, cookieItem in ipairs(splitCookieString) do
                        for y, cookiesItem in ipairs(cookiesArray) do
                          if string.find(cookieItem, cookiesItem) ~= nil then
                            local cookieKV = stringSplit(cookieItem, "=")
                            local cookieName = string.gsub(cookieKV[1], "%s+", "")
                            dynamicMetadata:set("envoy.filters.http.lua.cookie", cookieName, cookieKV[2])
                          end
                        end
                      end
                    end
                  end

            # simple cookie extraction with header_to_metadata filter
            - name: envoy.filters.http.header_to_metadata
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config
                request_rules:
                - cookie: TESTCOOKIE
                  on_header_present:
                    metadata_namespace: request.cookie
                    key: PHPSESSID
                    type: STRING 

            - name: envoy.filters.http.ratelimit
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
                domain: test
                enable_x_ratelimit_headers: DRAFT_VERSION_03
                failure_mode_deny: true
                rate_limit_service:
                  transport_api_version: V3
                  grpc_service:
                    envoy_grpc:
                      cluster_name: rate_limit_cluster
            
            # set the x-envoy-immediate-health-check-fail header on all responses if the /healthcheck/fail
            - name: envoy.filters.http.health_check
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
                pass_through_mode: false
                headers:
                - name: ":path"
                  string_match:
                    exact: "/healthz"

            - name: envoy.filters.http.router
    routes:
    - name: test
      virtual_hosts:
      - name: test
        retry_policy:
          retry_on: "cancelled,connect-failure,gateway-error,refused-stream,reset,resource-exhausted,unavailable"
          num_retries: 1
          retry_host_predicate:
          - name: envoy.retry_host_predicates.previous_hosts
          host_selection_retry_max_attempts: 3
          retry_priority:
            name: envoy.retry_priorities.previous_priorities
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.retry.priority.previous_priorities.v3.PreviousPrioritiesConfig
              update_frequency: 2
        domains:
        - "*"
        rate_limits:
        - actions:
          - header_value_match:
              descriptor_value: no-cf-connecting-ip
              expect_match: false
              headers:
              - name: "cf-connecting-ip"
        - actions:
          - request_headers:
              header_name: cf-connecting-ip
              descriptor_key: cf-connecting-ip
        routes:
        - match:
            prefix: "/1"
          route:
            cluster: local_service1
        - match:
            prefix: "/2"
          route:
            weighted_clusters:
              clusters:
              - name: local_service1
                weight: 50
              - name: local_service2
                weight: 50
        - match:
            prefix: "/test-exact-match"
            headers:
            - name: "create-xhprof-of-request"
              string_match:
                exact: "true"
          route:
            cluster: paket-xhprof
        - match:
            path: "/test-regex-match"
            headers:
            - name: "cookie"
              string_match:
                safe_regex:
                  google_re2: {}
                  regex: ".*?(CanaryUser=true).*?"
          route:
            cluster: local_service1
        - match:
            prefix: "/no-ratelimits"
          route:
            cluster: local_service2
          typed_per_filter_config:
            envoy.filters.http.ratelimit:
              "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimitPerRoute
              vh_rate_limits: IGNORE
        - match:
            prefix: "/tls-cluster-example"
          route:
            cluster: tls-cluster-example
        - match:
            prefix: "/aggregate-cluster"
          route:
            cluster: aggregate-cluster
        - match:
            prefix: "/"
          route:
            cluster: local_service2
    clusters:
    - name: local_service1
      connect_timeout: 0.25s
      lb_policy: ROUND_ROBIN
      type: EDS
      ignore_health_on_host_removal: true
      eds_cluster_config:
        eds_config:
          resource_api_version: V3
          api_config_source:
            api_type: GRPC
            transport_api_version: V3
            grpc_services:
            - envoy_grpc:
                cluster_name: xds_cluster
    - name: local_service2
      connect_timeout: 0.25s
      lb_policy: ROUND_ROBIN
      type: STRICT_DNS
      circuit_breakers:
        thresholds:
        - max_connections: 10
          max_pending_requests: 10
          max_requests: 10
      health_checks:
      - timeout: 1s
        interval: 1200s
        unhealthy_threshold: 3
        healthy_threshold: 1
        http_health_check:
          path: "/healthz"
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          common_tls_context:
            tls_certificate_sds_secret_configs:
            - name: envoy_control_plane_default
              sds_config:
                resource_api_version: V3
                api_config_source:
                  api_type: GRPC
                  transport_api_version: V3
                  grpc_services:
                  - envoy_grpc:
                      cluster_name: xds_cluster
      load_assignment:
        cluster_name: local_service2
        endpoints:
        - locality:
            zone: us-east-1a
          lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: local-service-a
                  port_value: 8001
        - locality:
            zone: us-east-1b
          lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: local-service-b
                  port_value: 8001
    - name: rate_limit_cluster
      connect_timeout: 0.25s
      lb_policy: ROUND_ROBIN
      type: STRICT_DNS
      typed_extension_protocol_options:
        envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
          "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
          explicit_http_config:
            http2_protocol_options: {}
      load_assignment:
        cluster_name: rate_limit_cluster
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: ratelimit
                  port_value: 8081
    - name: admin_cluster
      connect_timeout: 0.25s
      lb_policy: ROUND_ROBIN
      type: STATIC
      load_assignment:
        cluster_name: admin_cluster
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: 127.0.0.1
                  port_value: 18000
    - name: tls-cluster-example
      connect_timeout: 1s
      type: STATIC
      health_checks:
      - timeout: 1s
        interval: 5s
        unhealthy_threshold: 3
        healthy_threshold: 1
        http_health_check:
          host: "some.com"
          path: "/status.php"
      load_assignment:
        cluster_name: tls-cluster-example
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: 127.0.0.1
                  port_value: 443
    - name: aggregate-cluster
      connect_timeout: 0.25s
      lb_policy: CLUSTER_PROVIDED
      cluster_type:
        name: envoy.clusters.aggregate
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.clusters.aggregate.v3.ClusterConfig
          clusters:
          - tls-cluster-example
          - local_service2
          - admin_cluster