values.yaml

replicaCount: 2

podDisruptionBudget: |
  maxUnavailable: 1

## ref: https://pracucci.com/graceful-shutdown-of-kubernetes-pods.html
terminationGracePeriodSeconds: 30

strategy: |
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 2
    maxUnavailable: 1

image:
  repository: envoyproxy/envoy
  tag: v1.12.0
  pullPolicy: IfNotPresent

command:
- /bin/sh

argsTemplate: |-
  - -c
  - /docker-entrypoint.sh envoy --service-node ${POD_NAME} --service-cluster {{ template "envoy.fullname" . }} -l debug -c /config/envoy.yaml

xdsLoader:
  image:
    repository: mumoshu/crossover
    tag: canary-693fd33
  syncInterval: 30s

smi:
  apiVersions:
    trafficSplits: v1alpha2

initContainersTemplate: |-
  - name: xds-init
    image: {{ .Values.xdsLoader.image.repository }}:{{ .Values.xdsLoader.image.tag }}
    command:
    - crossover
    args:
    - --apiserver={{ .Values.apiserver }}
    - --configmap={{ template "envoy.fullname" . }}-xds
    {{ range $name, $svc := .Values.services -}}
    {{ if $svc.smi.enabled -}}
    - --trafficsplit={{ $name }}
    {{ end -}}
    {{ end -}}
    - --trafficsplit-api-version={{ .Values.smi.apiVersions.trafficSplits }}
    - --onetime
    - --insecure
    env:
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    volumeMounts:
    - name: xds
      mountPath: /srv/runtime

sidecarContainersTemplate: |-
  - name: xds-update
    image: {{ .Values.xdsLoader.image.repository }}:{{ .Values.xdsLoader.image.tag }}
    command:
    - crossover
    args:
    - --apiserver={{ .Values.apiserver }}
    - --configmap={{ template "envoy.fullname" . }}-xds
    {{ range $name, $svc := .Values.services -}}
    {{ if $svc.smi.enabled -}}
    - --trafficsplit={{ $name }}
    {{ end -}}
    {{ end -}}
    - --trafficsplit-api-version={{ .Values.smi.apiVersions.trafficSplits }}
    - --sync-interval={{ .Values.xdsLoader.syncInterval }}
    - --watch
    - --insecure
    env:
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    volumeMounts:
    - name: xds
      mountPath: /srv/runtime

volumes:
- name: xds
  emptyDir: {}

volumeMounts:
- name: xds
  mountPath: /srv/runtime

## Client service.
service:
  enabled: true
  ## Service name is user-configurable for maximum service discovery flexibility.
  name: envoy
  type: ClusterIP
  annotations: {}
    ## AWS example for use with LoadBalancer service type.
    # external-dns.alpha.kubernetes.io/hostname: envoy.cluster.local
    # service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
    # service.beta.kubernetes.io/aws-load-balancer-internal: "true"
  ports:
    n0:
      port: 10000
      targetPort: n0
      protocol: TCP

ports:
  admin:
    containerPort: 9901
    protocol: TCP
  n0:
    containerPort: 10000
    protocol: TCP

resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

priorityClassName: ""

nodeSelector: {}

tolerations: []

affinity: {}
  # podAntiAffinity:
  #   preferredDuringSchedulingIgnoredDuringExecution:
  #     - weight: 50
  #       podAffinityTerm:
  #         topologyKey: failure-domain.beta.kubernetes.io/zone
  #         labelSelector:
  #           matchLabels:
  #             release: envoy
  #   requiredDuringSchedulingIgnoredDuringExecution:
  #     - weight: 40
  #       topologyKey: "kubernetes.io/hostname"
  #       labelSelector:
  #         matchLabels:
  #           release: envoy

## ref: https://github.com/envoyproxy/envoy/pull/2896
podAnnotations: {}
  # prometheus.io/scrape: "true"
  # prometheus.io/path: "/stats/prometheus"
  # prometheus.io/port: "9901"

podLabels: {}
  # team: "developers"
  # service: "envoy"

livenessProbe:
  tcpSocket:
    port: admin
  initialDelaySeconds: 30
  # periodSeconds: 10
  # timeoutSeconds: 5
  # failureThreshold: 3
  # successThreshold: 1

readinessProbe:
  tcpSocket:
    port: admin
  initialDelaySeconds: 30
  # periodSeconds: 10
  # timeoutSeconds: 5
  # failureThreshold: 3
  # successThreshold: 1

securityContext: {}

env:
  POD_NAMESPACE:
    valueFrom:
      fieldRef:
        fieldPath: metadata.namespace
  POD_NAME:
    valueFrom:
      fieldRef:
        fieldPath: metadata.name

## Uncomment this section to use helm values to dynamically generate enovy.yaml
templates:
  envoy.yaml: |-
    ## refs:
    ## - https://www.envoyproxy.io/docs/envoy/latest/start/start#quick-start-to-run-simple-example
    ## - https://raw.githubusercontent.com/envoyproxy/envoy/master/configs/google_com_proxy.v2.yaml
    admin:
      access_log_path: /dev/stdout
      address:
        socket_address:
          address: 0.0.0.0
          port_value: {{ .Values.ports.admin.containerPort }}
    static_resources:
      listeners:
      - name: listener_0
        address:
          socket_address:
            address: 0.0.0.0
            port_value: {{ .Values.ports.n0.containerPort }}
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              # see https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/network/http_connection_manager/v2/http_connection_manager.proto#envoy-api-msg-config-filter-network-http-connection-manager-v2-httpconnectionmanager
              access_log:
              - name: envoy.file_access_log
                config:
                  path: /dev/stdout
              stat_prefix: ingress_http
              # This needs to be `http2` rather than `auto` if the downstream requires H2C upgrade.
              # Envoy's `auto` codec_type doesn't support H2C upgrades for the downstream.
              #
              # But beware that making this not `auto` disables the H2C upgrades for Envoy, too!
              # So you can't `curl --http2` to test it anymore. Use `curl --http2-prior-knowledge` instead.
              #
              # So in nutshell:
              #   codec_type: auto -> envoy(h1, h2c-upgrade, h2c-pri), upstream(h2c)
              #   codec_type: http2 -> envoy(h2c-pri), upstream(h2c)
              #
              # The downstream support for H2C upgrades is tracked at https://github.com/envoyproxy/envoy/issues/7161
              codec_type: {{ .Values.codecType }}
              rds:
                route_config_name: {{ .Values.route.name }}
                config_source:
                  path: /srv/runtime/current/rds.yaml
              http_filters:
              - name: envoy.router
      clusters:
      {{ range $_, $service := .Values.services -}}
      {{ range $name, $svc := $service.backends -}}
      - name: {{ $name | replace "." "_" }}
        connect_timeout: 0.25s
        type: strict_dns
        dns_lookup_family: V4_ONLY
        lb_policy: round_robin
        {{ if $svc.http2 -}}
        {{ if $svc.http2.enabled -}}
        http2_protocol_options: {{ default (dict) $svc.http2.protocol_options | toJson }}
        {{ end -}}
        {{ end -}}
        # IMHO this is a must-have when STRICT_DNS is used for SD
        # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/cds.proto#envoy-api-field-cluster-drain-connections-on-host-removal
        drain_connections_on_host_removal: true
        load_assignment:
          cluster_name: {{ $name | replace "." "_" }}
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: {{ $name }}
                    port_value: {{ $svc.port }}
      {{ end -}}
      {{ end -}}

xds:
  rds.yaml: |-
    version_info: "0"
    resources:
    # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/rds.proto
    - "@type": type.googleapis.com/envoy.api.v2.RouteConfiguration
      name: {{ .Values.route.name }}
      # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto#envoy-api-msg-route-virtualhost
      virtual_hosts:
      {{ range $serviceName, $service := .Values.services -}}
      - name: {{ $serviceName }}
        domains:
        - "*"
        # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto#envoy-api-msg-route-route
        routes:
        - match:
            prefix: "/"
          # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto#envoy-api-msg-route-routeaction
          route:
            # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto#envoy-api-msg-route-weightedcluster
            weighted_clusters:
              # https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto#envoy-api-msg-route-weightedcluster-clusterweight
              clusters:
              {{ $sum := 0 }}
              {{ range $name, $svc := $service.backends -}}
              {{ $sum = add $sum $svc.weight }}
              - name: {{ $name | replace "." "_" }}
                weight: {{ $svc.weight }}
                {{ if $svc.per_filter_config -}}
                per_filter_config:
                  {{ $svc.per_filter_config | toYaml | nindent 14 }}
                {{ end -}}
                {{ if $svc.request_headers_to_add -}}
                # See https://github.com/envoyproxy/envoy/pull/2765
                request_headers_to_add:
                  {{ $svc.request_headers_to_add | toYaml | nindent 14 }}
                {{ end -}}
              {{ end }}
              {{ if ne $sum 100 }}
              {{ fail (printf "%s: %d" "Sum of weights in the weighted_cluster should add up to 100" $sum) }}
              {{ end }}
      {{ end -}}
    #eof

# or auto if you want Envoy to serve HTTP/1.1 and H2C upgrades AND the downstream is HTTP/2, H2C
codecType: auto
#codecType: http2

route:
  name: podinfo

apiserver: https://kubernetes.default

## ServiceMonitor consumed by prometheus-operator
serviceMonitor:
  ## If the operator is installed in your cluster, set to true to create a Service Monitor Entry
  enabled: false
  interval: "15s"
  ## Namespace in which the service monitor is created
  # namespace: monitoring
  # Added to the ServiceMonitor object so that prometheus-operator is able to discover it
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
  additionalLabels: {}

## PrometheusRule consumed by prometheus-operator
prometheusRule:
  enabled: false
  ## Namespace in which the prometheus rule is created
  # namespace: monitoring
  ## Define individual alerting rules as required
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#rulegroup
  ##      https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/
  groups:
    upstream-rules:
      enabled: true
      rules:
        high4xxRate:
          enabled: true
          alert: High4xxRate
          expr: sum(rate(envoy_cluster_upstream_rq_xx{response_code_class="4"}[1m])) / sum(rate(envoy_cluster_upstream_rq_xx[1m])) * 100 > 1
          for: 1m
          labels:
            severity: page
          annotations:
            summary: "4xx response rate above 1%"
            description: "The 4xx error response rate for envoy cluster {{ $labels.envoy_cluster_name }} reported a service replication success rate of {{ $value }}% for more than 1 minute."
  ## Added to the PrometheusRule object so that prometheus-operator is able to discover it
  ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
  additionalLabels: {}