forked from hail-is/hail
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathenvoy.yaml
185 lines (185 loc) · 7.24 KB
/
envoy.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
apiVersion: v1
kind: ConfigMap
metadata:
name: gateway-envoy-config
data:
envoy.yaml: |
static_resources:
listeners:
- address:
socket_address:
address: 0.0.0.0
port_value: 8080
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
codec_type: AUTO
stat_prefix: ingress_http
access_log:
name: json_access_log
typed_config:
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
log_format:
json_format:
message: "%LOCAL_REPLY_BODY%"
status: "%RESPONSE_CODE%"
duration: "%DURATION%"
remote_address: "%DOWNSTREAM_REMOTE_ADDRESS%"
x_real_ip: "%REQ(X-Real-IP)%"
request_start_time: "%START_TIME%"
bytes_sent: "%BYTES_SENT%"
http_referer: "%REQ(Referer)%"
http_user_agent: "%REQ(User-Agent)%"
route_config:
name: http_routes
virtual_hosts:
- name: revoke
domains:
- "bogus-for-revoke.*"
routes: []
- name: default_http
domains: ["*"]
routes:
- match:
prefix: "/.well-known/acme-challenge"
route:
timeout: 0s
cluster: letsencrypt
- match:
prefix: "/"
redirect:
https_redirect: true
http_filters:
- name: envoy.filters.http.router
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
- address:
socket_address:
address: 0.0.0.0
port_value: 8443
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
codec_type: AUTO
stat_prefix: ingress_http
upgrade_configs:
- upgrade_type: websocket
use_remote_address: true
skip_xff_append: false
access_log:
name: json_access_log
typed_config:
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
log_format:
json_format:
message: "%LOCAL_REPLY_BODY%"
status: "%RESPONSE_CODE%"
duration: "%DURATION%"
remote_address: "%DOWNSTREAM_REMOTE_ADDRESS%"
x_real_ip: "%REQ(X-Real-IP)%"
request_start_time: "%START_TIME%"
bytes_sent: "%BYTES_SENT%"
http_referer: "%REQ(Referer)%"
http_user_agent: "%REQ(User-Agent)%"
rds:
route_config_name: https_routes
config_source:
resource_api_version: V3
path_config_source:
path: /config_map/xds/rds.yaml
watched_directory:
path: /config_map/xds
http_filters:
- name: envoy.filters.http.ext_authz
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
http_service:
server_uri:
uri: https://auth:443
cluster: auth
timeout: 0.25s
path_prefix: /api/v1alpha/verify_dev_credentials?url=
authorization_request:
allowed_headers:
patterns:
- exact: "Cookie"
ignore_case: true
- exact: "X-Hail-Internal-Authorization"
ignore_case: true
- name: envoy.filters.http.local_ratelimit
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
stat_prefix: http_local_rate_limiter
- name: envoy.filters.http.router
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
local_reply_config:
mappers:
- filter:
status_code_filter:
comparison:
op: EQ
value:
default_value: 401
runtime_key: key_b
headers_to_add:
- header:
key: "Location"
value: "https://auth.{{ domain }}/login?https://:authority:path"
append: false
status_code: 302
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
common_tls_context:
tls_certificates:
- certificate_chain:
filename: /etc/letsencrypt/fullchain.pem
private_key:
filename: /etc/letsencrypt/privkey.pem
tls_params:
tls_minimum_protocol_version: TLSv1_2
cipher_suites:
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
clusters:
- name: letsencrypt
type: STRICT_DNS
lb_policy: ROUND_ROBIN
load_assignment:
cluster_name: letsencrypt
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: letsencrypt.default.svc.cluster.local
port_value: 80
admin:
address:
socket_address:
address: 0.0.0.0
port_value: 8001
layered_runtime:
layers:
- name: static_layer_0
static_layer:
envoy:
resource_limits:
listener:
example_listener_name:
connection_limit: 10000
dynamic_resources:
cds_config:
resource_api_version: V3
path_config_source:
path: /config_map/xds/cds.yaml
watched_directory:
path: /config_map/xds