service-envoy.yaml

node:
  id: "id_identity"
  cluster: "cluster_identity"
static_resources:
  listeners:
    - name: listener_0
      transparent: true
      address:
        socket_address:
          protocol: TCP
          address: 0.0.0.0
          port_value: 4999
      filter_chains:
        - filters:
            - name: envoy.http_connection_manager
              config:
                idle_timeout: 1s
                codec_type: auto
                access_log:
                  - name: envoy.file_access_log
                    config:
                      path: "/tmp/envoy-access-4999.log"
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: local_service
                      domains:
                        - "*"
                      routes:
                        - match:
                            prefix: "/"
                          route:
                            cluster: cluster1
                http_filters:
                  # Authz filters must be the first one for it to work
                  # https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/http/ext_authz/v2/ext_authz.proto#envoy-api-msg-config-filter-http-ext-authz-v2-extauthz
                  - name: envoy.ext_authz
                    config:
                      failure_mode_allow: false
                      grpc_service:
                        envoy_grpc:
                          cluster_name: ext-authz
                  - name: envoy.router
                    typed_config: {}
      listener_filters:
        - name: envoy.listener.original_dst
          typed_config: {}
  clusters:
    - name: cluster1
      type: ORIGINAL_DST
      connect_timeout: 6s
      lb_policy: ORIGINAL_DST_LB
      dns_lookup_family: V4_ONLY
    - name: ext-authz
      type: STRICT_DNS
      http2_protocol_options: {}
      load_assignment:
        cluster_name: ext-authz
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: localhost
                      port_value: 5010
      # This timeout controls the initial TCP handshake timeout - not the timeout for the
      # entire request.
      connect_timeout: 0.25s
cluster_manager: {}
watchdog: {}
admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 19000