-
Notifications
You must be signed in to change notification settings - Fork 9
/
envoy.yaml
122 lines (122 loc) · 4.91 KB
/
envoy.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
admin:
access_log_path: ./admin_access.log
address:
socket_address:
protocol: TCP
address: 0.0.0.0
port_value: 8081
node:
# See https://github.com/envoyproxy/envoy/blob/master/api/envoy/config/core/v3/base.proto#L136
# It is needed when we use xDS as it allows an SDS server to identify a
# specific Envoy instance and conditionally serve data.
id: egodemo
cluster: egodemo
static_resources:
secrets:
- name: /ego-demo/secrets
generic_secret:
secret:
inline_string: |
{
"egodemo-hmac-api-key":"API_KEY_SECRET",
"egodemo-hmac-api-secret":"API_TOKEN_SECRET"
}
listeners:
- name: api
address:
socket_address:
protocol: TCP
address: 0.0.0.0
port_value: 8080
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
codec_type: auto
stat_prefix: ingress_http
access_log:
- name: envoy.access_loggers.file
typed_config:
"@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
path: "/dev/stdout"
route_config:
name: local_route
virtual_hosts:
- name: www
domains:
- "*"
routes:
- match:
prefix: /hmac/unsigned
route:
cluster: echo
typed_per_filter_config:
ego_http:
"@type": type.googleapis.com/ego.http.SettingsPerRoute
filters:
security:
"@type": type.googleapis.com/ego.security.Requirement
provider_name: simple_hmac_example
- match:
path: "/hmac/signed"
route:
cluster: echo
typed_per_filter_config:
ego_http:
"@type": type.googleapis.com/ego.http.SettingsPerRoute
filters:
security:
"@type": type.googleapis.com/ego.security.Requirement
provider_name: signed_hmac_example
- match:
# catch-all
prefix: /
route:
cluster: echo
http_filters:
- name: ego-http
typed_config:
"@type": type.googleapis.com/ego.http.Settings
filter: getheader
settings:
"@type": type.googleapis.com/egodemo.getheader.Settings
key: x-getheader-result
src: http://127.0.0.1:8888/echo
hdr: x-powered-by
- name: ego_http
typed_config:
"@type": type.googleapis.com/ego.http.Settings
filter: security
sds_secret_config:
name: /ego-demo/secrets
settings:
"@type": type.googleapis.com/ego.security.Settings
providers:
simple_hmac_example:
custom_hmac_provider:
request_validation_url: "http://127.0.0.1:8889/verify"
service_key: "egodemo-hmac-api-key"
service_token: "egodemo-hmac-api-secret"
signed_hmac_example:
custom_hmac_provider:
request_validation_url: "http://127.0.0.1:8889/verify"
response_signing_url: "http://127.0.0.1:8889/sign"
service_key: "egodemo-hmac-api-key"
service_token: "egodemo-hmac-api-secret"
sign_resp: true
- name: envoy.filters.http.router
clusters:
- name: echo
connect_timeout: 0.25s
type: STATIC
lb_policy: ROUND_ROBIN
load_assignment:
cluster_name: echo
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: 127.0.0.1
port_value: 8888