envoy.yaml

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }
static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address: { address: 0.0.0.0, port_value: 8000 }
      filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              codec_type: auto
              stat_prefix: ingress_http
              route_config:
                name: local_route
                virtual_hosts:
                  - name: local_service
                    domains: ["*"]
                    routes:
                      - match: { prefix: "/" }
                        route:
                          cluster: gRPC_endpoint
                          max_grpc_timeout: 0s
                      - match:
                          prefix: "/"
                        route:
                          cluster: application_frontend
                    cors:
                      allow_origin_string_match:
                        - safe_regex:
                            google_re2: {}
                            regex: \*
                      allow_methods: GET, PUT, DELETE, POST, OPTIONS
                      allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout,x-custom-header,token
                      max_age: "1728000"
                      expose_headers: token,custom-header-1,grpc-status,grpc-message
              http_filters:
                - name: envoy.grpc_web
                - name: envoy.cors
                - name: envoy.router
                  config: {}
          tls_context:
            common_tls_context:
              alpn_protocols: "h2"
              tls_certificates:
                - certificate_chain:
                    filename: "/etc/certs/fullchain.pem"
                  private_key:
                    filename: "/etc/certs/privkey.pem"
  clusters:
    - name: gRPC_endpoint
      connect_timeout: 0.25s
      type: strict_dns
      http2_protocol_options: {}
      lb_policy: round_robin
      hosts: [{ socket_address: { address: 172.17.0.1, port_value: 5454  }}]
      tls_context:
        common_tls_context:
          tls_certificates:
            certificate_chain: {"filename": "/etc/certs/fullchain.pem"}
            private_key: {"filename": "/etc/certs/privkey.pem"}

    - name: application_frontend
      connect_timeout: 0.25s
      type: strict_dns
      lb_policy: round_robin
      dns_lookup_family: V4_ONLY
      http2_protocol_options: {}
      load_assignment:
        cluster_name: application_frontend
        endpoints:
        - lb_endpoints:
          - endpoint:
               address:
                 socket_address:
                   address: 127.0.0.1
                   port_value: 8003
      tls_context:
        common_tls_context:
          tls_certificates:
            certificate_chain: {"filename": "/etc/certs/fullchain.pem"}
            private_key: {"filename": "/etc/certs/privkey.pem"}