static_resources:
  listeners:
  - address:
      socket_address:
        address: 0.0.0.0
        port_value: ${ENVOY_PORT}
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          codec_type: AUTO
          stat_prefix: ingress_http
          access_log:
            - name: envoy.access_loggers.stdout
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
          route_config:
            name: local_route
            virtual_hosts:
            - name: upstream
              require_tls: EXTERNAL_ONLY
              request_headers_to_remove:
                - x-auth-introspect-value
                - x-auth-request-access-token
              domains:
              - "*"
              routes:
              - match:
                  prefix: "/logout"
                request_headers_to_add:
                  - header:
                      key: "X-Auth-Request-Redirect"
                      value: ${IAM_TERMINATE_SESSION_URL}
                typed_per_filter_config:
                  envoy.filters.http.ext_authz:
                   "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
                   disabled: true
                route:
                  cluster: oauth-proxy-service
                  prefix_rewrite: "/oauth2/sign_out"
              - match:
                  prefix: "/IamTokenExchangeBroker"
                route:
                  cluster: sso_authenticator
              - match:
                  prefix: "/store/fhir"
                request_headers_to_add:
                - header:
                   key: "api-version"
                   value: "1"
                - header:
                   key: "Accept"
                   value: "application/json"
                request_headers_to_remove:
                   - edisp-introspect-value
                route:
                  cluster: cdr-service
                  host_rewrite_literal: cdr-edisa-test.us-east.philips-healthsuite.com
              - match:
                  prefix: "/mockserviceA"
                route:
                  cluster: mockserviceA
                request_headers_to_add:
                  - header:
                      key: "custom-header"
                      value: "100"                      
              - match:
                  prefix: "/mockserviceB"
                route:
                  cluster: mockserviceB
              - match:
                  prefix: "/mockserviceX"
                route:
                  cluster: mockserviceX
              - match:
                  prefix: "/FilterService"
                route:
                  cluster: FilterService
              - match:
                  prefix: "/prefixrewritetest"
                route:
                  cluster: mockserviceA
                  prefix_rewrite: "/mockserviceA"             
              - match:
                  prefix: "/oauth2/callback"
                route:
                  cluster: oauth-proxy-service
              - match:
                  prefix: "/"
                route:
                  cluster: mountebank                                   
          http_filters:
          - name: envoy.filters.http.lua
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
              inline_code: |
                function envoy_on_request(request_handle)
                   local library = require("lib.envoyLibrary")
                   library.SelectAuthenticationFlow(request_handle)
                end
                function envoy_on_response(response_handle)
                  local library = require("lib.envoyLibrary")
                  library.setIntrospectionValue(response_handle)
                  response_handle:headers():remove("x-auth-introspect-value")
                end
          - name: envoy.filters.http.ext_authz
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
              transport_api_version: V3
              http_service:
                server_uri:
                  uri:  ${OAUTH_PROXY_ENDPOINT}:${OAUTH_PROXY_PORT}
                  cluster: oauth-proxy-service
                  timeout: ${TimeoutInSeconds}
                authorization_request:
                  allowed_headers:
                    patterns:
                     - exact: cookie
                     - prefix: x-
                authorization_response:
                  allowed_client_headers:
                    patterns:
                     - exact: set-cookie
                  allowed_client_headers_on_success:
                    patterns:
                     - exact: set-cookie
                     - prefix: x-auth-introspect
                  allowed_upstream_headers:
                    patterns:
                     - exact: set-cookie
                     - prefix: x-auth-request-access
                     - prefix: x-auth-introspect
              filter_enabled_metadata:
                filter: envoy.filters.http.ext_authz
                path:
                - key: login_flow
                value:
                  bool_match: true
          - name: envoy.filters.http.ext_authz
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
              transport_api_version: V3
              http_service:
                server_uri:
                  uri:  ${SSO_AUTHENTICATOR_ENDPOINT}:${SSO_AUTHENTICATOR_PORT}
                  cluster: sso_authenticator
                  timeout: ${TimeoutInSeconds}
                authorization_request:
                  allowed_headers:
                    patterns:
                     - prefix: edisp-
                authorization_response:
                  allowed_upstream_headers:
                    patterns:
                     - prefix: auth
              filter_enabled_metadata:
                filter: envoy.filters.http.ext_authz
                path:
                - key: vuepacs_sso_token_flow
                value:
                  bool_match: true
          - name: envoy.filters.http.ext_authz
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
              transport_api_version: V3
              http_service:
                server_uri:
                  uri:  ${AUTHENTICATOR_ENDPOINT}:${AUTHENTICATOR_PORT}
                  cluster: authenticator
                  timeout: ${TimeoutInSeconds}
                authorization_request:
                  allowed_headers:
                    patterns:
                     - exact: cookie
                     - prefix: x-
                authorization_response:
                  allowed_upstream_headers:
                    patterns:
                     - prefix: x-auth-introspect
              filter_enabled_metadata:
                filter: envoy.filters.http.ext_authz
                path:
                - key: access_token_flow
                value:
                  bool_match: true
          - name: envoy.filters.http.lua
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
              inline_code: |
                function envoy_on_request(request_handle)
                   local library = require("lib.envoyLibrary")
                   library.setAccessToken(request_handle)
                   library.setIntrospectionValue(request_handle)
                end
          - name: envoy.filters.http.router
            typed_config: {}
  clusters:
  - name: mountebank
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: mountebank
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${MOUNTEBANK_ENDPOINT}
                port_value: ${MOUNTEBANK_PORT}
  - name: mockserviceA
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: mockserviceA
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${MOUNTEBANK_ENDPOINT}
                port_value: 4545
  - name: FilterService
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: FilterService
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${MOUNTEBANK_ENDPOINT}
                port_value: 4547
  - name: mockserviceB
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: mockserviceB
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${MOUNTEBANK_ENDPOINT}
                port_value: 4546
  - name: mockserviceX
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: mockserviceB
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${MONTEBANKSERVICEDOWNTEST}
                port_value: 4550
  - name: sso_authenticator
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: sso_authenticator
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${SSO_AUTHENTICATOR_ENDPOINT}
                port_value: ${SSO_AUTHENTICATOR_PORT}
  - name: oauth-proxy-service
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    load_assignment:
      cluster_name: oauth-proxy-service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${OAUTH_PROXY_ENDPOINT}
                port_value: ${OAUTH_PROXY_PORT}
  - name: authenticator
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: authenticator
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: ${AUTHENTICATOR_ENDPOINT}
                port_value: ${AUTHENTICATOR_PORT}
  - name: cdr-service
    connect_timeout: ${TimeoutInSeconds}
    type: logical_dns
    load_assignment:
      cluster_name: cdr-service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: cdr-edisa-test.us-east.philips-healthsuite.com
                port_value: 443
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        common_tls_context:
          validation_context:
            trusted_ca:
              filename: /etc/ssl/certs/ca-certificates.crt
            match_subject_alt_names:
            - exact: cdr-edisa-test.us-east.philips-healthsuite.com