envoy.yaml

# Copyright 2020 Google LLC
# 
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
# 
#       http://www.apache.org/licenses/LICENSE-2.0
# 
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.

# This is for Envoy 1.16+.

admin:
  access_log_path: /tmp/envoy_admin.log
  address:
    socket_address:
      address: 127.0.0.1
      port_value: 9000

static_resources:
  listeners:
  - address:
      socket_address: { address: 0.0.0.0, port_value: 8080 }

    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:  
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          upgrade_configs:
          - upgrade_type: websocket
          route_config:
            virtual_hosts:
            - name: default
              domains: "*"
              routes:
              - match: { prefix: /graphql }
                route:
                  cluster: graphql
                  prefix_rewrite: /
              - match: { prefix: /ws }
                route:
                  cluster: ws
                  prefix_rewrite: /
                  host_rewrite_header: websocket
              - match: { prefix: /com.apigee.examples.grpc.server.grpcserver.MessengerService }
                route:
                  cluster: grpc

          http_filters:
          - name: envoy.filters.http.lua
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
              ### This one will be called on every single call
              inline_code: |
                function starts_with(str, start)
                  return str:sub(1, #start) == start
                end

                function envoy_on_request(rh)
                  local p = rh:headers():get(":path")
                  if starts_with(p,'/graphql') then
                    rh:logInfo("Handling path: "..p)
                    rh:headers():add("x-target-name", "graphql")
                  elseif starts_with(p,'/ws') then
                    rh:logInfo("Handling path: "..p)
                    rh:headers():add("x-target-name", "websocket")
                  elseif starts_with(p,'/com.apigee.examples.grpc.server.grpcserver.MessengerService') then
                    rh:logInfo("Handling path: "..p)
                    rh:headers():add("x-target-name", "grpc")
                  else
                    rh:logInfo("Handling path: "..p)
                    rh:headers():add("x-target-name", "unknown")
                  end
                end
                function envoy_on_response(rh)
                  --
                end
          # evaluate JWT tokens, allow_missing allows API Key also
          - name: envoy.filters.http.jwt_authn
            typed_config: 
              "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
              providers:
                apigee:
                  issuer: https://34-117-138-147.nip.io//remote-token/token
                  audiences:
                  - remote-service-client
                  remote_jwks:
                    http_uri:
                      uri: https://34-117-138-147.nip.io/remote-token/certs
                      cluster: apigee-auth-service
                      timeout: 5s
                    cache_duration:
                      seconds: 300
                  payload_in_metadata: https://34-117-138-147.nip.io//remote-token/token
              rules:
              - match:
                  prefix: /
                requires:
                  requires_any:
                    requirements:
                    - provider_name: apigee
                    - allow_missing: {}

          # evaluate Apigee rules
          - name: envoy.filters.http.ext_authz
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
              transport_api_version: V3
              grpc_service:
                envoy_grpc:
                  cluster_name: apigee-remote-service-envoy
                timeout: 1s
              metadata_context_namespaces:
              - envoy.filters.http.jwt_authn

          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

          access_log: 

          # collect Apigee analytics
          - name: envoy.access_loggers.http_grpc
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
              common_config:
                transport_api_version: V3
                grpc_service:
                  envoy_grpc:
                    cluster_name: apigee-remote-service-envoy
                log_name: apigee-remote-service-envoy

  clusters:

  # define cluster for graphql target
  - name: graphql
    connect_timeout: 2s
    type: LOGICAL_DNS
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: graphql
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: "graphql.local"
                port_value: 4000

  # define cluster for ws target
  - name: ws
    connect_timeout: 2s
    type: LOGICAL_DNS
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: ws
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: "ws.local"
                port_value: 8000

  # define cluster for grpc target
  - name: grpc
    connect_timeout: 2s
    type: LOGICAL_DNS
    http2_protocol_options: {}
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: grpc
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: "grpc.local"
                port_value: 9090

  # define cluster for Apigee remote service
  - name: apigee-remote-service-envoy
    type: LOGICAL_DNS
    http2_protocol_options: {}
    load_assignment:
      cluster_name: apigee-remote-service-envoy
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: "envoy_adapter.local"
                port_value: 5000
    common_lb_config:
      healthy_panic_threshold:
        value: 50.0
    health_checks:
      - timeout: 1s
        interval: 5s
        interval_jitter: 1s
        no_traffic_interval: 5s
        unhealthy_threshold: 1
        healthy_threshold: 3
        grpc_health_check: {}
    connect_timeout: 0.25s

  # define cluster for Apigee JWKS certs
  - name: apigee-auth-service
    connect_timeout: 2s
    type: LOGICAL_DNS
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: apigee-auth-service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: "34-117-138-147.nip.io"
                port_value: "443"
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: "34-117-138-147.nip.io"