service-envoy.yaml

node:
  id: "id_identity"
  cluster: "cluster_identity"
static_resources:
  listeners:
    - address:
        socket_address:
          address: 0.0.0.0
          port_value: 4999
      filter_chains:
        - filters:
            - name: envoy.http_connection_manager
              # https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/network/http_connection_manager/v2/http_connection_manager.proto#envoy-api-field-config-filter-network-http-connection-manager-v2-httpconnectionmanager-use-remote-address
              config:
                idle_timeout: 1s
                use_remote_address: true
                skip_xff_append: false
                codec_type: auto
                access_log:
                  - name: envoy.file_access_log
                    config:
                      path: "/tmp/envoy-access-4999.log"
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: local_service
                      domains: ["*"]
                      routes:
                        - match:
                            prefix: "/"
                          route:
                            cluster: simple-server
                http_filters:
                  # Authz filters must be the first one for it to work
                  # https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/http/ext_authz/v2/ext_authz.proto#envoy-api-msg-config-filter-http-ext-authz-v2-extauthz
                  - name: envoy.ext_authz
                    config:
                      failure_mode_allow: false
                      grpc_service:
                        envoy_grpc:
                          cluster_name: ext-authz
                  - name: envoy.router

  clusters:
    - name: simple-server
      connect_timeout: 0.25s
      type: STRICT_DNS
      lb_policy: round_robin
      hosts:
        - socket_address:
            address: localhost
            port_value: 5000
    - name: ext-authz
      type: STRICT_DNS
      http2_protocol_options: {}
      load_assignment:
        cluster_name: ext-authz
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: localhost
                      port_value: 5010
      # This timeout controls the initial TCP handshake timeout - not the timeout for the
      # entire request.
      connect_timeout: 0.25s

admin:
  access_log_path: "/dev/null"
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 19000