envoy.yaml

node:
  id: "backend"
  cluster: "demo-cluster-spire"
static_resources:
  listeners:
  - name: local_service
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 9001
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          common_http_protocol_options:
            idle_timeout: 1s
          forward_client_cert_details: sanitize_set
          set_current_client_cert_details:
              uri: true
          codec_type: auto
          access_log:
          - name: envoy.file_access_log
            config:
              path: "/tmp/inbound-proxy.log"
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: local_service
          http_filters:
          - name: envoy.ext_authz
            typed_config:
              "@type": type.googleapis.com/envoy.config.filter.http.ext_authz.v2.ExtAuthz
              with_request_body:
                max_request_bytes: 8192
                allow_partial_message: true
              failure_mode_allow: false
              grpc_service:
                google_grpc:
                  target_uri: 127.0.0.1:8182
                  stat_prefix: ext_authz
                timeout: 0.5s              
          - name: envoy.router
      tls_context:
        common_tls_context:
          tls_certificate_sds_secret_configs:
          - name: "spiffe://example.org/ns/default/sa/default/backend"
            sds_config:
              api_config_source:
                api_type: GRPC
                grpc_services:
                  envoy_grpc:
                    cluster_name: spire_agent
          combined_validation_context:
            # validate the SPIFFE ID of incoming clients (optionally)
            default_validation_context:
              match_subject_alt_names:
                - exact: "spiffe://example.org/ns/default/sa/default/frontend"
                - exact: "spiffe://example.org/ns/default/sa/default/frontend-2"
            # obtain the trust bundle from SDS
            validation_context_sds_secret_config:
              name: "spiffe://example.org"
              sds_config:
                api_config_source:
                  api_type: GRPC
                  grpc_services:
                    envoy_grpc:
                      cluster_name: spire_agent
          tls_params:
            ecdh_curves:
              - X25519:P-256:P-521:P-384
  clusters:
  - name: spire_agent
    connect_timeout: 0.25s
    http2_protocol_options: {}
    hosts:
      - pipe:
          path: /run/spire/sockets/agent.sock
  - name: local_service
    connect_timeout: 1s
    type: strict_dns
    hosts:
      - socket_address:
          address: 127.0.0.1
          port_value: 80