apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy
  namespace: proxy
data:
  config.yaml: |
    node:
      id: envoy
      cluster: envoy

    admin:
      access_log_path: /dev/stdout
      address:
        socket_address:
          protocol: TCP
          address: 0.0.0.0
          port_value: 9901

    static_resources:
      listeners:
      - name: listener_https
        address:
          socket_address:
            protocol: TCP
            address: 0.0.0.0
            port_value: 443
        access_log:
          name: envoy.access_loggers.file
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
            path: /dev/stdout
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
              codec_type: auto
              stat_prefix: ingress_http
              route_config:
                name: local_route
                virtual_hosts:
                - name: backend
                  domains:
                  - "{{ .Values.spire.trust_domain }}"
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: backend
              http_filters:
              - name: envoy.filters.http.router
                typed_config: {}
          transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              require_client_certificate: true
              common_tls_context:
                alpn_protocols: h2,http/1.1
                tls_certificate_sds_secret_configs:
                - name: "spiffe://{{ .Values.spire.trust_domain }}/ns/proxy/sa/default"
                  sds_config:
                    api_config_source:
                      api_type: GRPC
                      grpc_services:
                        envoy_grpc:
                          cluster_name: spire_agent
                validation_context_sds_secret_config:
                  name: "spiffe://{{ .Values.spire.trust_domain }}"
                  sds_config:
                    api_config_source:
                      api_type: GRPC
                      grpc_services:
                        envoy_grpc:
                          cluster_name: spire_agent

      clusters:
      - name: spire_agent
        connect_timeout: 0.25s
        http2_protocol_options: {}
        load_assignment:
          cluster_name: spire_agent
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  pipe:
                    path: /run/spire/sockets/agent.sock

      - name: backend
        connect_timeout: 0.25s
        type: STRICT_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        http2_protocol_options: {}
        load_assignment:
          cluster_name: backend
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: backend.backend
                    port_value: 443
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
            common_tls_context:
              alpn_protocols: h2,http/1.1
              tls_certificate_sds_secret_configs:
              - name: "spiffe://{{ .Values.spire.trust_domain }}/ns/proxy/sa/default"
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    grpc_services:
                      envoy_grpc:
                        cluster_name: spire_agent
              validation_context_sds_secret_config:
                name: "spiffe://{{ .Values.spire.trust_domain }}"
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    grpc_services:
                      envoy_grpc:
                        cluster_name: spire_agent
