ec-web.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ec-web-envoy-config
  namespace: default
data:
  envoy.yaml: |
    admin:
      access_log_path: /var/log/envoy_admin_access.log
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 9901
    node:
      id: "id_01"
      cluster: "cluster_01"
    static_resources:
      listeners:
      - name: ingress-listener
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 8000
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              idle_timeout: 1s
              forward_client_cert_details: sanitize_set
              set_current_client_cert_details:
                  uri: true
              codec_type: auto
              access_log:
              - name: envoy.file_access_log
                config:
                  path: "/var/log/envoy_access.log"
              stat_prefix: ingress_http
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: ec-web
              http_filters:
              - name: envoy.ext_authz
                config:
                  failure_mode_allow: false
                  grpc_service:
                    google_grpc:
                      target_uri: 127.0.0.1:20000
                      stat_prefix: ext_authz
                    timeout: 0.5s
              - name: envoy.router
      - name: mtls-listener-requesting-ec-backend
        address:
          socket_address:
            address: 127.0.0.1
            port_value: 9000
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              idle_timeout: 1s
              forward_client_cert_details: sanitize_set
              set_current_client_cert_details:
                  uri: true
              codec_type: auto
              access_log:
              - name: envoy.file_access_log
                config:
                  path: "/var/log/envoy_access.log"
              stat_prefix: ingress_http
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: requesting-ec-backend
              http_filters:
              - name: envoy.router
      clusters:
      - name: spire_agent
        connect_timeout: 0.25s
        http2_protocol_options: {}
        hosts:
          - pipe:
              path: /run/spire/sockets/agent.sock
      - name: ec-web
        connect_timeout: 0.25s
        type: strict_dns
        lb_policy: ROUND_ROBIN
        hosts:
          - socket_address:
              address: 127.0.0.1
              port_value: 10000
      - name: requesting-ec-backend
        connect_timeout: 0.25s
        type: strict_dns
        lb_policy: ROUND_ROBIN
        hosts:
          - socket_address:
              address: ec-backend
              port_value: 8000
        tls_context:
          common_tls_context:
            tls_certificate_sds_secret_configs:
              - name: "spiffe://example.org/ec-web"
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    grpc_services:
                      envoy_grpc:
                        cluster_name: spire_agent
            combined_validation_context:
              default_validation_context:
                verify_subject_alt_name:
                  - "spiffe://example.org/ec-backend"
              validation_context_sds_secret_config:
                name: "spiffe://example.org"
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    grpc_services:
                      envoy_grpc:
                        cluster_name: spire_agent
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ec-web-nginx-config
  namespace: default
data:
  default.conf: |
    upstream ec-backend-via-envoy {
      server 127.0.0.1:9000;
    }

    server {
      listen 10000;
      server_name localhost;

      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

      error_page 403 @forbidden;

      location /noproxy {
        return 200 "ec-web no proxy endpoint";
      }

      location / {
        proxy_pass http://ec-backend-via-envoy;
        proxy_intercept_errors on;
      }

      location @forbidden {
        return 403 "Forbidden. Not authorized by ec-backend's OPA.";
      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ec-web-opa-config
  namespace: default
data:
  config.yaml: |
    plugins:
      envoy_ext_authz_grpc:
        addr: :20000
        query: data.envoy.authz.allow
  policy.rego: |
    package envoy.authz

    import input.attributes.request.http as http_request
    import input.attributes.source.address as source_address

    default allow = false

    allow {
        http_request.method == "GET"
        http_request.headers["x-opa-secret"] == "ec-web-secret"
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ec-web
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ec-web
  template:
    metadata:
      labels:
        app: ec-web
    spec:
      containers:
        - name: envoy
          image: envoyproxy/envoy:v1.12.2
          command: ["/usr/local/bin/envoy"]
          args: ["--config-path","/etc/envoy/envoy.yaml"]
          ports:
          - containerPort: 8000
          volumeMounts:
            - name: ec-web-envoy-config
              mountPath: /etc/envoy
              readOnly: true
            - name: spire-agent-socket
              mountPath: /run/spire/sockets
              readOnly: true
        - name: ec-web
          image: nginx:1.17.6
          ports:
          - containerPort: 10000
          volumeMounts:
            - name: ec-web-nginx-config
              mountPath: /etc/nginx/conf.d
              readOnly: true
        - name: opa
          image: openpolicyagent/opa:0.15.1-istio
          args: ["run","--log-level=debug","--server","--config-file","/etc/opa/config.yaml","/etc/opa/policy.rego"]
          ports:
          - containerPort: 20000
          volumeMounts:
            - name: ec-web-opa-config
              mountPath: /etc/opa
              readOnly: true
            - name: spire-agent-socket
              mountPath: /run/spire/sockets
              readOnly: true
      volumes:
        - name: ec-web-envoy-config
          configMap:
            name: ec-web-envoy-config
        - name: spire-agent-socket
          hostPath:
            path: /run/spire/sockets
            type: Directory
        - name: ec-web-nginx-config
          configMap:
            name: ec-web-nginx-config
        - name: ec-web-opa-config
          configMap:
            name: ec-web-opa-config
---
apiVersion: v1
kind: Service
metadata:
  name: ec-web
  namespace: default
spec:
  type: NodePort
  ports:
    - name: envoy-port
      port: 8000
      targetPort: 8000
    - name: envoy-admin-port
      port: 9901
      targetPort: 9901
  selector:
    app: ec-web
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ec-web
  namespace: default
spec:
  rules:
  - host: ec-web.example.org
    http:
      paths:
      - backend:
          serviceName: ec-web
          servicePort: 8000