---
apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-config
data:
  envoy.yaml: |-
    admin:
      access_log_path: /dev/stdout
      address:
        socket_address:
          protocol: TCP
          address: 0.0.0.0
          port_value: 9901
    static_resources:
      listeners:
        - name: listener_web_https
          address:
            socket_address:
              protocol: TCP
              address: 0.0.0.0
              port_value: 443
          filter_chains:
            - filters:
                - name: envoy.http_connection_manager
                  config:
                    codec_type: auto
                    stat_prefix: ingress_http
                    # Necessary as ONG returns auth requests over HTTP 1.0
                    http_protocol_options:
                      accept_http_10: true
                    route_config:
                      name: local_tls_route
                      virtual_hosts:
                        - name: web_tls_service
                          domains: ["*"]
                          per_filter_config:
                            envoy.ext_authz:
                              check_settings:
                                context_extensions:
                                  virtual_host: web_tls_service
                          routes:
                          - match:
                              prefix: "/"
                              headers:
                                - name: x-emissary-auth
                                  present_match: true
                            route:
                              cluster: app_container
                          - match:
                              prefix: "/"
                            per_filter_config:
                              envoy.ext_authz:
                                disabled: true
                            route:
                              cluster: app_container
                    http_filters:
                      - name: envoy.ext_authz
                        config:
                          http_service:
                            server_uri:
                              uri: ext-authz
                              cluster: ext-authz
                              timeout: 1s
                            authorization_request:
                              headers_to_add:
                                - key: x-emissary-mode
                                  value: "ingress"
                              allowed_headers:
                                patterns:
                                  - exact: x-emissary-auth
                            authorization_response:
                              allowed_upstream_headers:
                                patterns:
                                  - exact: x-emissary-auth-status
                              allowed_client_headers:
                                patterns:
                                  - exact: x-emissary-auth-status
                      - name: envoy.router
              tls_context:
                common_tls_context:
                  tls_certificates:
                    - certificate_chain:
                        filename: "/etc/ssl/localhost.crt"
                      private_key:
                        filename: "/etc/ssl/localhost.key"
        - name: egress
          address:
            socket_address:
              protocol: TCP
              address: 0.0.0.0
              port_value: 18000
          filter_chains:
          - filters:
            - name: envoy.http_connection_manager
              config:
                codec_type: auto
                stat_prefix: egress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                  - name: egress
                    domains:
                    - "*"
                    routes:
                    - match:
                        prefix: "/"
                      route:
                        cluster: egress
                http_filters:
                  - name: envoy.ext_authz
                    config:
                      http_service:
                        server_uri:
                          uri: ext-authz
                          cluster: ext-authz
                          timeout: 1s
                        authorization_request:
                          headers_to_add:
                            - key: x-emissary-mode
                              value: "egress"
                        authorization_response:
                          allowed_upstream_headers:
                            patterns:
                              - exact: x-emissary-auth
                  - name: envoy.router
      clusters:
        - name: app_container
          connect_timeout: 0.25s
          type: LOGICAL_DNS
          # Comment out the following line to test on v6 networks
          dns_lookup_family: V4_ONLY
          lb_policy: ROUND_ROBIN
          load_assignment:
            cluster_name: app_container
            endpoints:
              - lb_endpoints:
                  - endpoint:
                      address:
                        socket_address:
                          address: localhost
                          port_value: 3001
        - name: egress
          connect_timeout: 2s
          type: strict_dns
          lb_policy: round_robin
          tls_context:
            common_tls_context:
              validation_context:
                trusted_ca:
                  filename: /etc/ssl/certs/ca-certificates.crt
          load_assignment:
            cluster_name: egress
            endpoints:
              - lb_endpoints:
                - endpoint:
                    address:
                      socket_address:
                        address: <name-of-egress-endpoint>
                        port_value: 443
        - name: ext-authz
          connect_timeout: 0.25s
          hosts:
            - pipe:
                path: /run/emissary/sockets/auth.sock
