323 lines
11 KiB
YAML
323 lines
11 KiB
YAML
static_resources:
|
|
listeners:
|
|
- address:
|
|
socket_address:
|
|
address: 0.0.0.0
|
|
port_value: ${ENVOY_PORT}
|
|
filter_chains:
|
|
- filters:
|
|
- name: envoy.filters.network.http_connection_manager
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
codec_type: AUTO
|
|
stat_prefix: ingress_http
|
|
access_log:
|
|
- name: envoy.access_loggers.stdout
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
|
|
route_config:
|
|
name: local_route
|
|
virtual_hosts:
|
|
- name: upstream
|
|
require_tls: EXTERNAL_ONLY
|
|
request_headers_to_remove:
|
|
- x-auth-introspect-value
|
|
- x-auth-request-access-token
|
|
domains:
|
|
- "*"
|
|
routes:
|
|
- match:
|
|
prefix: "/logout"
|
|
request_headers_to_add:
|
|
- header:
|
|
key: "X-Auth-Request-Redirect"
|
|
value: ${IAM_TERMINATE_SESSION_URL}
|
|
typed_per_filter_config:
|
|
envoy.filters.http.ext_authz:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
|
|
disabled: true
|
|
route:
|
|
cluster: oauth-proxy-service
|
|
prefix_rewrite: "/oauth2/sign_out"
|
|
- match:
|
|
prefix: "/IamTokenExchangeBroker"
|
|
route:
|
|
cluster: sso_authenticator
|
|
- match:
|
|
prefix: "/store/fhir"
|
|
request_headers_to_add:
|
|
- header:
|
|
key: "api-version"
|
|
value: "1"
|
|
- header:
|
|
key: "Accept"
|
|
value: "application/json"
|
|
request_headers_to_remove:
|
|
- edisp-introspect-value
|
|
route:
|
|
cluster: cdr-service
|
|
host_rewrite_literal: cdr-edisa-test.us-east.philips-healthsuite.com
|
|
- match:
|
|
prefix: "/mockserviceA"
|
|
route:
|
|
cluster: mockserviceA
|
|
request_headers_to_add:
|
|
- header:
|
|
key: "custom-header"
|
|
value: "100"
|
|
- match:
|
|
prefix: "/mockserviceB"
|
|
route:
|
|
cluster: mockserviceB
|
|
- match:
|
|
prefix: "/mockserviceX"
|
|
route:
|
|
cluster: mockserviceX
|
|
- match:
|
|
prefix: "/FilterService"
|
|
route:
|
|
cluster: FilterService
|
|
- match:
|
|
prefix: "/prefixrewritetest"
|
|
route:
|
|
cluster: mockserviceA
|
|
prefix_rewrite: "/mockserviceA"
|
|
- match:
|
|
prefix: "/oauth2/callback"
|
|
route:
|
|
cluster: oauth-proxy-service
|
|
- match:
|
|
prefix: "/"
|
|
route:
|
|
cluster: mountebank
|
|
http_filters:
|
|
- name: envoy.filters.http.lua
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
|
|
inline_code: |
|
|
function envoy_on_request(request_handle)
|
|
local library = require("lib.envoyLibrary")
|
|
library.SelectAuthenticationFlow(request_handle)
|
|
end
|
|
function envoy_on_response(response_handle)
|
|
local library = require("lib.envoyLibrary")
|
|
library.setIntrospectionValue(response_handle)
|
|
response_handle:headers():remove("x-auth-introspect-value")
|
|
end
|
|
- name: envoy.filters.http.ext_authz
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
|
|
transport_api_version: V3
|
|
http_service:
|
|
server_uri:
|
|
uri: ${OAUTH_PROXY_ENDPOINT}:${OAUTH_PROXY_PORT}
|
|
cluster: oauth-proxy-service
|
|
timeout: ${TimeoutInSeconds}
|
|
authorization_request:
|
|
allowed_headers:
|
|
patterns:
|
|
- exact: cookie
|
|
- prefix: x-
|
|
authorization_response:
|
|
allowed_client_headers:
|
|
patterns:
|
|
- exact: set-cookie
|
|
allowed_client_headers_on_success:
|
|
patterns:
|
|
- exact: set-cookie
|
|
- prefix: x-auth-introspect
|
|
allowed_upstream_headers:
|
|
patterns:
|
|
- exact: set-cookie
|
|
- prefix: x-auth-request-access
|
|
- prefix: x-auth-introspect
|
|
filter_enabled_metadata:
|
|
filter: envoy.filters.http.ext_authz
|
|
path:
|
|
- key: login_flow
|
|
value:
|
|
bool_match: true
|
|
- name: envoy.filters.http.ext_authz
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
|
|
transport_api_version: V3
|
|
http_service:
|
|
server_uri:
|
|
uri: ${SSO_AUTHENTICATOR_ENDPOINT}:${SSO_AUTHENTICATOR_PORT}
|
|
cluster: sso_authenticator
|
|
timeout: ${TimeoutInSeconds}
|
|
authorization_request:
|
|
allowed_headers:
|
|
patterns:
|
|
- prefix: edisp-
|
|
authorization_response:
|
|
allowed_upstream_headers:
|
|
patterns:
|
|
- prefix: auth
|
|
filter_enabled_metadata:
|
|
filter: envoy.filters.http.ext_authz
|
|
path:
|
|
- key: vuepacs_sso_token_flow
|
|
value:
|
|
bool_match: true
|
|
- name: envoy.filters.http.ext_authz
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
|
|
transport_api_version: V3
|
|
http_service:
|
|
server_uri:
|
|
uri: ${AUTHENTICATOR_ENDPOINT}:${AUTHENTICATOR_PORT}
|
|
cluster: authenticator
|
|
timeout: ${TimeoutInSeconds}
|
|
authorization_request:
|
|
allowed_headers:
|
|
patterns:
|
|
- exact: cookie
|
|
- prefix: x-
|
|
authorization_response:
|
|
allowed_upstream_headers:
|
|
patterns:
|
|
- prefix: x-auth-introspect
|
|
filter_enabled_metadata:
|
|
filter: envoy.filters.http.ext_authz
|
|
path:
|
|
- key: access_token_flow
|
|
value:
|
|
bool_match: true
|
|
- name: envoy.filters.http.lua
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
|
|
inline_code: |
|
|
function envoy_on_request(request_handle)
|
|
local library = require("lib.envoyLibrary")
|
|
library.setAccessToken(request_handle)
|
|
library.setIntrospectionValue(request_handle)
|
|
end
|
|
- name: envoy.filters.http.router
|
|
typed_config: {}
|
|
clusters:
|
|
- name: mountebank
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: mountebank
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${MOUNTEBANK_ENDPOINT}
|
|
port_value: ${MOUNTEBANK_PORT}
|
|
- name: mockserviceA
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: mockserviceA
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${MOUNTEBANK_ENDPOINT}
|
|
port_value: 4545
|
|
- name: FilterService
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: FilterService
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${MOUNTEBANK_ENDPOINT}
|
|
port_value: 4547
|
|
- name: mockserviceB
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: mockserviceB
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${MOUNTEBANK_ENDPOINT}
|
|
port_value: 4546
|
|
- name: mockserviceX
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: mockserviceB
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${MONTEBANKSERVICEDOWNTEST}
|
|
port_value: 4550
|
|
- name: sso_authenticator
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: sso_authenticator
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${SSO_AUTHENTICATOR_ENDPOINT}
|
|
port_value: ${SSO_AUTHENTICATOR_PORT}
|
|
- name: oauth-proxy-service
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
load_assignment:
|
|
cluster_name: oauth-proxy-service
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${OAUTH_PROXY_ENDPOINT}
|
|
port_value: ${OAUTH_PROXY_PORT}
|
|
- name: authenticator
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
lb_policy: ROUND_ROBIN
|
|
load_assignment:
|
|
cluster_name: authenticator
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: ${AUTHENTICATOR_ENDPOINT}
|
|
port_value: ${AUTHENTICATOR_PORT}
|
|
- name: cdr-service
|
|
connect_timeout: ${TimeoutInSeconds}
|
|
type: logical_dns
|
|
load_assignment:
|
|
cluster_name: cdr-service
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: cdr-edisa-test.us-east.philips-healthsuite.com
|
|
port_value: 443
|
|
transport_socket:
|
|
name: envoy.transport_sockets.tls
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
|
|
common_tls_context:
|
|
validation_context:
|
|
trusted_ca:
|
|
filename: /etc/ssl/certs/ca-certificates.crt
|
|
match_subject_alt_names:
|
|
- exact: cdr-edisa-test.us-east.philips-healthsuite.com |