apiVersion: v1
kind: ConfigMap
metadata:
  name: apiserver-proxy-config
  namespace: kube-system
  labels:
    gardener.cloud/role: system-component
    origin: gardener
data:
  envoy.yaml: |-
    overload_manager:
      refresh_interval: 0.25s
      resource_monitors:
      - name: "envoy.resource_monitors.fixed_heap"
        typed_config:
          "@type": type.googleapis.com/envoy.config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig
          max_heap_size_bytes: 20971520 # 20 MiB
      actions:
      - name: "envoy.overload_actions.shrink_heap"
        triggers:
        - name: "envoy.resource_monitors.fixed_heap"
          threshold:
            value: 0.95
      - name: "envoy.overload_actions.stop_accepting_requests"
        triggers:
        - name: "envoy.resource_monitors.fixed_heap"
          threshold:
            value: 0.98
    layered_runtime:
      layers:
        - name: static_layer_0
          static_layer:
            envoy:
              resource_limits:
                listener:
                  kube_apiserver:
                    connection_limit: 2000
            overload:
              global_downstream_max_connections: 10000
    admin:
      access_log_path: /dev/stout
      address:
        pipe:
          # The admin interface should not be exposed as a TCP address.
          # It's only used and exposed via the metrics lister that
          # exposes only /stats/prometheus path for metrics scrape.
          path: /etc/admin-uds/admin.socket
    static_resources:
      listeners:
      - name: kube_apiserver
        address:
          socket_address:
            address: {{ .Values.advertiseIPAddress }}
            port_value: 443
        per_connection_buffer_limit_bytes: 32768 # 32 KiB
        filter_chains:
        - filters:
          - name: envoy.filters.network.tcp_proxy
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
              stat_prefix: kube_apiserver
              cluster: kube_apiserver
      - name: metrics
        address:
          socket_address:
            address: 0.0.0.0
            port_value: {{ .Values.adminPort }}
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: ingress_http
              use_remote_address: true
              common_http_protocol_options:
                idle_timeout: 8s
                max_connection_duration: 10s
                max_headers_count: 20
                max_stream_duration: 8s
                headers_with_underscores_action: REJECT_REQUEST
              http2_protocol_options:
                max_concurrent_streams: 5
                initial_stream_window_size: 65536
                initial_connection_window_size: 1048576
              stream_idle_timeout: 8s
              request_timeout: 9s
              codec_type: AUTO
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      path: /metrics
                    route:
                      cluster: uds_admin
                      prefix_rewrite: /stats/prometheus
                  - match:
                      path: /ready
                    route:
                      cluster: uds_admin
              http_filters:
              - name: envoy.filters.http.router

      clusters:
      - name: kube_apiserver
        connect_timeout: 5s
        per_connection_buffer_limit_bytes: 32768 # 32 KiB
        type: LOGICAL_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: kube_apiserver
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: {{ .Values.proxySeedServer.host }}
                    port_value: {{ .Values.proxySeedServer.port }}
        transport_socket:
          name: envoy.transport_sockets.upstream_proxy_protocol
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
            config:
              version: V2
            transport_socket:
              name: envoy.transport_sockets.raw_buffer
      - name: uds_admin
        connect_timeout: 0.25s
        type: STATIC
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: uds_admin
          endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    pipe:
                      path: /etc/admin-uds/admin.socket
        transport_socket:
          name: envoy.transport_sockets.raw_buffer
