envoy_front_proxy.template.json

{% import 'routing_helper.template.json' as helper -%}

{% macro listener(address) %}
  {
    "address": "{{ address }}",
    {% if kwargs['ssl'] -%}
    "ssl_context": {
      "alpn_protocols": "h2,http/1.1",
      "alt_alpn_protocols": "http/1.1",
      {% if kwargs.get('pin_double_proxy_client', False) -%}
      "ca_cert_file": "certs/cacert.pem",
      {# This should be the hash of the /etc/envoy/envoy-double-proxy.pem cert used in the
         double proxy configuration. #}
      "verify_certificate_hash": "fill me in",
      {% endif -%}
      "cert_chain_file": "certs/servercert.pem",
      "private_key_file": "certs/serverkey.pem"
    },
    {% endif -%}
    {% if kwargs['proxy_proto'] -%}
    "use_proxy_proto": true,
    {% endif -%}
    "filters": [
    {
      "name": "http_connection_manager",
      "config": {
        "codec_type": "auto",
        "add_user_agent": true,
        "tracing": {
          "operation_name": "ingress"
        },
        "idle_timeout_s": 840,
        "access_log": [
        {
          "path": "/var/log/envoy/access_error.log",
          "filter": {"type": "logical_or", "filters": [
              {"type": "status_code", "op": ">=", "value": 500},
              {"type": "duration", "op": ">=", "value": 1000},
              {"type": "traceable_request"}
            ]
          }
        },
        {
          "path": "/var/log/envoy/access.log"
        }],
        "stat_prefix": "router",
        {% if kwargs['proxy_proto'] -%}
        "use_remote_address": true,
        {% endif -%}
        "route_config": {% include kwargs['router_file'] %},
        "filters": [
          { "name": "health_check",
            "config": {
              "pass_through_mode": false, "endpoint": "/healthcheck"
            }
          },
          { "name": "buffer",
            "config": {
              "max_request_bytes": 5242880,
              "max_request_time_s": 120
            }
          },
          { "name": "rate_limit",
            "config" : {
              "domain": "envoy_front",
              "request_type": "external"
            }
          },
          { "name": "router", "config": {} }
        ]
      }
    }]
  }
{% endmacro %}

{
  "listeners": [
    {# TCP listeners for public HTTP/HTTPS endpoints. Assumes a TCP LB in front such as ELB which
       supports proxy proto. #}
    {{ listener("tcp://0.0.0.0:9300", ssl=True, proxy_proto=True, router_file='envoy_router.template.json') }},
    {{ listener("tcp://0.0.0.0:9301", ssl=False, proxy_proto=True, router_file='envoy_router.template.json') }},

    {# TCP listener for backhaul traffic from the double proxy.
       See envoy_double_proxy.template.json #}
    {{ listener("tcp://0.0.0.0:9400", ssl=True, proxy_proto=False, pin_double_proxy_client=True,
                router_file='envoy_router.template.json') }}
  ],

  "admin": { "access_log_path": "/var/log/envoy/admin_access.log",
             "address": "tcp://0.0.0.0:9901" },
  "flags_path": "/etc/envoy/flags",
  "statsd_tcp_cluster_name": "statsd",

  "tracing": {
    "http": {
      "driver": {
          "type": "lightstep",
          "config": {
            "access_token_file": "/etc/envoy/lightstep_access_token",
            "collector_cluster": "lightstep_saas"
          }
      }
    }
  },

  "runtime": {
    "symlink_root": "/srv/runtime_data/current",
    "subdirectory": "envoy",
    "override_subdirectory": "envoy_override"
  },

  "rate_limit_service": {
    "type": "grpc_service",
    "config": {
      "cluster_name": "ratelimit"
    }
  },

  "cluster_manager": {
    "outlier_detection": {
      "event_log_path": "/var/log/envoy/outlier_events.log"
    },

    "sds": {
      "cluster": {
        "name": "sds",
        "connect_timeout_ms": 250,
        "type": "strict_dns",
        "lb_type": "round_robin",
        "hosts": [{"url": "tcp://discovery.yourcompany.net:80"}]
      },
      "refresh_delay_ms": 30000
    },

    "clusters": [
    {
      "name": "statsd",
      "connect_timeout_ms": 250,
      "type": "static",
      "lb_type": "round_robin",
      "hosts": [{"url": "tcp://127.0.0.1:8125"}]
    },
    {
      "name": "lightstep_saas",
      "features": "http2",
      "ssl_context": {
        "ca_cert_file": "certs/cacert.pem",
        "verify_subject_alt_name": ["collector-grpc.lightstep.com"]
      },
      "connect_timeout_ms": 1000,
      "type": "logical_dns",
      "lb_type": "round_robin",
      "hosts": [{"url": "tcp://collector-grpc.lightstep.com:443"}]
    },
    {% for service, options in clusters.iteritems() -%}
    {
      {{ helper.internal_cluster_definition(service, options) }}
    }{% if not loop.last %},{% endif %}
    {% endfor -%}
    ]
  }
}