Envoy プロキシのデプロイ設定

clusters:
  - name: sigsci-agent-grpc
    connect_timeout: 0.2s
    type: strict_dns
    #lb_policy: LEAST_REQUEST
    http2_protocol_options: {}
    #tls_context: {}
    ### You can also use 'hosts' below, but this is deprecated
    load_assignment:
      cluster_name: sigsci-agent-grpc
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: sigsci-agent
                port_value: 8000

http_filters:
- name: envoy.filters.http.ext_authz
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
    transport_api_version: V3
    grpc_service:
        envoy_grpc:
            cluster_name: sigsci-agent-grpc
        timeout: 0.2s
    failure_mode_allow: true
    with_request_body:
      # Maximum request body bytes buffered and sent to the sigsci-agent
      max_request_bytes: 8192
      # NOTE: If allow_partial_message is set false, then any request over
      # the above max bytes will fail with an HTTP "413 Payload Too Large"
      # so it is recommended to set this to true.
      allow_partial_message: true
      # NOTE: By default, envoy carries the HTTP request body as a UTF-8 string
      # and it fills the body @ # field. To pack the request body as raw bytes,
      # set pack_as_bytes to true.
      pack_as_bytes: true
- name: envoy.filters.http.router
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

access_log:
- name: envoy.http_grpc_access_log
   typed_config:
    "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
    common_config:
      log_name: "sigsci-agent-grpc"
      transport_api_version: V3
      grpc_service:
        envoy_grpc:
          cluster_name: sigsci-agent-grpc
        timeout: 0.2s
    additional_request_headers_to_log:
    # These sigsci-agent headers are required for correct processing:
    - "x-sigsci-request-id"
    - "x-sigsci-waf-response"
    # Optionally, additional headers can be added that should be recorded:
    - "accept"
    - "content-type"
    - "content-length"
    additional_response_headers_to_log:
    - "date"
    - "server"
    - "content-type"
    - "content-length"

http_filters:
          - name: envoy.lua
            config:
              inline_code: |
                -- Add a special header to pass the encoded body
                function envoy_on_request(req)
                  local len = 0
                  local reqbody
                  -- Determine the body length
                  local cl = req:headers():get("content-length")
                  if cl ~= nil then
                    len = tonumber(cl)
                  end
                  -- gRPC does not have a content-length header to limit the body before buffering
                  if len == 0 and req:headers():get("content-type") == "application/grpc" then
                    -- Triggers buffering
                    len = req:body():length()
                  end
                  -- Limit body length sent to the agent (adjust as needed)
                  if len > 0 and len <= 8192 then
                    -- Triggers buffering
                    reqbody = req:body():getBytes(0, len)
                    -- Encode the body for use in a header value
                    local enc, t = string.gsub(reqbody, "[^%w]", function(chr)
                      return string.format("%%%02X",string.byte(chr))
                    end)
                    req:headers():add("x-sigsci-encoded-body", enc)
                  end
                end
          - name: envoy.ext_authz
            config:
              grpc_service:
                envoy_grpc:
                  cluster_name: sigsci-agent-grpc
                timeout: 0.2s
              failure_mode_allow: true
#              with_request_body:
#                max_request_bytes: 8192
#                allow_partial_message: true
          - name: envoy.router
            config: {}

additional_request_headers_to_log:
# These sigsci-agent headers are required for correct processing:
- "x-sigsci-request-id"
- "x-sigsci-waf-response"
# Optionally, additional headers can be added that should be recorded:
- "accept"
- "content-type"
- "content-length"
- "x-real-ip"

additional_response_headers_to_log:
- "date"
- "server"
- "content-type"
- "content-length"

# ConfigMap: Contains the Envoy configuration with ext_authz integration.
apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-config
data:
  envoy.yaml: |
    node:
      id: proxy-node
      cluster: proxy-cluster
    static_resources:
      listeners:
      - name: listener_0
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 10000
        filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                  - name: backend
                    domains: ["*"]
                    routes:
                    - match:
                        prefix: "/"
                      route:
                        cluster: edge_cluster
                        host_rewrite_literal: "http.edgecompute.app"
                    cors:
                      allow_origin_string_match:
                        - prefix: "*"
                      allow_methods: GET, PUT, DELETE, POST, OPTIONS
                      allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout
                      max_age: "1728000"
                      expose_headers: custom-header-1,grpc-status,grpc-message

                access_log:
                - name: envoy.access_loggers.stdout
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
                - name: envoy.http_grpc_access_log
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
                    common_config:
                      log_name: "sigsci-agent-grpc"
                      transport_api_version: V3
                      grpc_service:
                        envoy_grpc:
                          cluster_name: sigsci-agent-grpc
                        timeout: 0.2s
                    additional_request_headers_to_log:
                    # These sigsci-agent headers are required for correct processing:
                    - "x-sigsci-request-id"
                    - "x-sigsci-waf-response"
                    # Optionally, additional headers can be added that should be recorded:
                    - "accept"
                    - "content-type"
                    - "content-length"
                    additional_response_headers_to_log:
                    - "date"
                    - "server"
                    - "content-type"
                    - "content-length"


                http_filters:
                # ext_authz filter calls the NGWAF agent via gRPC.
                - name: envoy.filters.http.ext_authz
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                    transport_api_version: V3
                    grpc_service:
                      envoy_grpc:
                        cluster_name: sigsci-agent-grpc
                    failure_mode_allow: false
                - name: envoy.filters.http.router
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
      clusters:
      # Cluster for forwarding requests to https://http.edgecompute.app.
      - name: edge_cluster
        connect_timeout: 0.25s
        type: LOGICAL_DNS
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: edge_cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: http.edgecompute.app
                    port_value: 443
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
            sni: "http.edgecompute.app"
      # Cluster used by the ext_authz filter to contact the NGWAF agent.
      - name: sigsci-agent-grpc
        connect_timeout: 0.25s
        type: STATIC
        lb_policy: ROUND_ROBIN
        http2_protocol_options: {}  # <--- This tells Envoy to use HTTP/2 for gRPC
        load_assignment:
          cluster_name: sigsci-agent-grpc
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    # Both containers share the same network namespace.
                    address: 127.0.0.1
                    port_value: 9999

---

# Deployment: Combines the Envoy proxy and the Next‑Gen WAF Agent sidecar.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: envoy-waf-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: envoy-waf
  template:
    metadata:
      labels:
        app: envoy-waf
    spec:
      containers:
      # Envoy container – set to use debug logging for detailed output.
      - name: envoy
        image: envoyproxy/envoy:v1.22-latest
        args:
          - "-c"
          - "/etc/envoy/envoy.yaml"
          - "-l"
          - "debug"    # Change to "trace" for even more verbosity.
        ports:
        - containerPort: 10000
        volumeMounts:
        - name: envoy-config
          mountPath: /etc/envoy
      # Next‑Gen WAF Agent container (sigsci-agent) configured for ext_authz (gRPC mode).
      - name: sigsci-agent
        image: signalsciences/sigsci-agent:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: SIGSCI_ACCESSKEYID
          valueFrom:
            secretKeyRef:
              name: sigsci.my-site-name-here
              key: accesskeyid
        - name: SIGSCI_SECRETACCESSKEY
          valueFrom:
            secretKeyRef:
              name: sigsci.my-site-name-here
              key: secretaccesskey
        # Instruct the agent to expect response data and configure its gRPC address.
        - name: SIGSCI_ENVOY_EXPECT_RESPONSE_DATA
          value: "1"
        - name: SIGSCI_ENVOY_GRPC_ADDRESS
          value: "localhost:9999"
        - name: SIGSCI_DEBUG_ALL_THE_THINGS
          value: "true"
        - name: SIGSCI_WAF_DATA_LOG
          value: "/dev/stdout"
        ports:
        - containerPort: 9999
        securityContext:
          readOnlyRootFilesystem: true
      volumes:
      - name: envoy-config
        configMap:
          name: envoy-config

---

# Service: Exposes the Envoy listener on port 10000.
apiVersion: v1
kind: Service
metadata:
  name: envoy
spec:
  selector:
    app: envoy-waf
  ports:
  - protocol: TCP
    port: 10000
    targetPort: 10000