apiVersion: v1
kind: ConfigMap

metadata:
  name: envoy-conf

data:
  envoy.yaml: |
    static_resources:
      listeners:
        - address:
            socket_address:
              address: 0.0.0.0
              port_value: 443

          per_connection_buffer_limit_bytes: 3145728 # 3MB

          filter_chains:
            - filters:
                - name: envoy.http_connection_manager
                  config:
                    stat_prefix: ingress_https
                    codec_type: AUTO
                    request_timeout: 300s # 5 mins
                    access_log:
                      - name: envoy.file_access_log
                        config:
                          path: "/var/log/access.log"

                    route_config:
                      name: local_route
                      virtual_hosts:
                        - name: local_service
                          domains:
                            - "*"

                          cors:
                            allow_origin_string_match:
                              - prefix: "*"
                            allow_methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
                            allow_headers: "*"
                            filter_enabled:
                              default_value:
                                numerator: 100
                                denominator: HUNDRED
                              runtime_key: cors.www.enabled
                            shadow_enabled:
                              default_value:
                                numerator: 0
                                denominator: HUNDRED
                              runtime_key: cors.www.shadow_enabled

                          routes:
                            # User Service
                            - match:
                                prefix: "/v1/users"
                              route:
                                cluster: user_service
                            - match:
                                prefix: "/v1/users/"
                              route:
                                cluster: user_service
                            # ToDo Service
                            - match:
                                prefix: "/v1/groups"
                              route:
                                cluster: todo_service
                            - match:
                                prefix: "/v1/groups/"
                              route:
                                cluster: todo_service
                            - match:
                                prefix: "/v1/tasks"
                              route:
                                cluster: todo_service
                            - match:
                                prefix: "/v1/tasks/"
                              route:
                                cluster: todo_service

                    http_filters:
                      - name: envoy.health_check
                        config:
                          pass_through_mode: false
                          headers:
                            - name: ":path"
                              exact_match: "/healthz"
                            - name: "x-envoy-livenessprobe"
                              exact_match: "healthz"
                      - name: envoy.cors
                        config: {}
                      - name: envoy.router
                        config: {}

              tls_context:
                common_tls_context:
                  tls_certificates:
                    - certificate_chain:
                        filename: "/etc/ssl/envoy/tls.crt"
                      private_key:
                        filename: "/etc/ssl/envoy/tls.key"

      clusters:
        - name: user_service
          type: LOGICAL_DNS
          dns_lookup_family: V4_ONLY
          lb_policy: ROUND_ROBIN
          connect_timeout: 15s
          per_connection_buffer_limit_bytes: 32768 # 32KiB
          hosts:
            - socket_address:
                address: user-api
                port_value: 8080
          health_checks:
            - timeout: 1s
              interval: 20s
              interval_jitter: 1s
              unhealthy_threshold: 3
              healthy_threshold: 3
              http_health_check:
                path: "/health"

        - name: todo_service
          type: LOGICAL_DNS
          dns_lookup_family: V4_ONLY
          lb_policy: ROUND_ROBIN
          connect_timeout: 15s
          per_connection_buffer_limit_bytes: 3145728 # 3MB
          hosts:
            - socket_address:
                address: todo-api
                port_value: 8080
          health_checks:
            - timeout: 1s
              interval: 20s
              interval_jitter: 1s
              unhealthy_threshold: 3
              healthy_threshold: 3
              http_health_check:
                path: "/health"

    admin:
      access_log_path: "/var/log/envoy_admin.log"
      address:
        socket_address:
          address: 127.0.0.1
          port_value: 8090
