envoy_service_to_service_v2.template.yaml

{% import 'routing_helper_v2.template.yaml' as helper -%}
{% import 'access_log_format_helper_v2.template.yaml' as access_log_helper -%}
{% macro ingress_listener(protocol, address, port_value) -%}
- address:
    socket_address:
      protocol: {{protocol}}
      address: {{address}}
      port_value: {{port_value}}
  filter_chains:
  - filters:
    - name: envoy.http_connection_manager
      config:
        codec_type: AUTO
        stat_prefix: ingress_http
        route_config:
          name: local_route
          virtual_hosts:
          - name: local_service
            domains:
            - "*"
            routes:
            - match:
                prefix: "/"
                headers:
                - name: content-type
                  exact_match: application/grpc
              route:
                cluster: local_service_grpc
            - match:
                prefix: "/"
              route:
                cluster: local_service
        http_filters:
        - name: envoy.health_check
          config:
           pass_through_mode: true
           headers:
             - name: ":path"
               exact_match: "/healthcheck"
           cache_time: 2.5s
        - name: envoy.buffer
          config:
           max_request_bytes: 5242880
           max_request_time: 120s
        - name: envoy.router
          config: {}
        access_log:
        - name: envoy.file_access_log
          filter:
            not_health_check_filter:  {}
          config:
            path: "/var/log/envoy/ingress_http.log"
            {{ access_log_helper.ingress_full()|indent(10)}}
        - name: envoy.file_access_log
          filter:
            and_filter:
              filters:
                - or_filter:
                    filters:
                    - status_code_filter:
                        comparison:
                          op: GE
                          value:
                            default_value: 400
                            runtime_key: access_log.access_error.status
                    - status_code_filter:
                        comparison:
                          op: EQ
                          value:
                            default_value: 0
                            runtime_key: access_log.access_error.status
                    - duration_filter:
                        comparison:
                          op: GE
                          value:
                            default_value: 2000
                            runtime_key: access_log.access_error.duration
                - not_health_check_filter: {}
          config:
            path: "/var/log/envoy/ingress_http_error.log"
            {{ access_log_helper.ingress_sampled_log()|indent(10)}}
        - name: envoy.file_access_log
          filter:
            and_filter:
              filters:
              - not_health_check_filter: {}
              - runtime_filter:
                  runtime_key:  access_log.ingress_http
          config:
            path: "/var/log/envoy/ingress_http_sampled.log"
            {{ access_log_helper.ingress_sampled_log()|indent(10)}}
        idle_timeout: 840s
        tracing:
          operation_name: INGRESS
{% endmacro -%}
static_resources:
  listeners:
  {{ ingress_listener("tcp", "0.0.0.0", 9211) | indent(2)}}
  - address:
      socket_address:
        protocol: TCP
        port_value: 9001
        address: 127.0.0.1
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          codec_type: AUTO
          stat_prefix: egress_http
          route_config:
            name: local_route
            virtual_hosts:
            {% for service, options in internal_virtual_hosts.iteritems() %}
            - name: {{ service }}
              domains:
              - {{ service }}
              routes:
              - match:
                  prefix: "/"
                route:
                  {{ helper.make_route_internal(service, options)|indent(16) }}
            {% endfor %}
          add_user_agent: true
          tracing:
            operation_name: EGRESS
          idle_timeout: 840s
          access_log:
          - name: envoy.file_access_log
            filter:
              or_filter:
                filters:
                  - status_code_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 400
                          runtime_key: access_log.access_error.status
                  - duration_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 2000
                          runtime_key: access_log.access_error.duration
                  - traceable_filter: {}
            config:
              path: "/var/log/envoy/egress_http_error.log"
              {{ access_log_helper.egress_error_log()|indent(10)}}
          use_remote_address: true
          http_filters:
          - name: envoy.rate_limit
            config:
              domain: envoy_service_to_service
          - name: envoy.grpc_http1_bridge
            config: {}
          - name: envoy.router
            config: {}

  - address:
      socket_address:
        protocol: TCP
        port_value: 9002
        address: 127.0.0.1
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          codec_type: AUTO
          stat_prefix: egress_http
          rds:
            config_source:
               api_config_source:
                 api_type: GRPC
                 grpc_services:
                   envoy_grpc:
                     cluster_name: "rds"
            route_config_name: rds_config_for_listener_1
          add_user_agent: true
          tracing:
            operation_name: EGRESS
          idle_timeout: 840s
          access_log:
          - name: envoy.file_access_log
            filter:
              or_filter:
                filters:
                  - status_code_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 400
                          runtime_key: access_log.access_error.status
                  - duration_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 2000
                          runtime_key: access_log.access_error.duration
                  - traceable_filter: {}
            config:
              path: "/var/log/envoy/egress_http_error.log"
              {{ access_log_helper.egress_error_log()|indent(10) }}
          use_remote_address: true
          http_filters:
          - name: envoy.rate_limit
            config:
              domain: envoy_service_to_service
          - name: envoy.grpc_http1_bridge
            config: {}
          - name: envoy.router
            config: {}
  {% if external_virtual_hosts|length > 0 or mongos_servers|length > 0 %}{% endif -%}
  {% for mapping in external_virtual_hosts -%}
  - name: "{{ mapping['address']}}"
    address:
      socket_address:
        address: "{{ mapping['address'] }}"
        protocol: TCP
        port_value: 9901
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          codec_type: AUTO
          idle_timeout: 840s
          stat_prefix: egress_{{ mapping['name'] }}
          #update access_logs here
          route_config:
            virtual_hosts:
            {% for host in mapping['hosts'] %}
            - name: egress_{{ host['name'] }}
              domains:
              - "{{ host['domain'] }}"
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: egress_{{ host['name'] }}
                  retry_policy:
                    retry_on: connect-failure
                  {% if host.get('host_rewrite', False) %}
                  host_rewrite: "{{host['host_rewrite']}}"
                  {% endif %}
            {% endfor %}
          http_filters:
          {% if mapping['name'] in ['dynamodb_iad', 'dynamodb_legacy'] -%}
          - name: envoy.http_dynamo_filter
            config: {}
          {% endif -%}
          - name: envoy.router
            config: {}
          access_log:
          - name: envoy.file_access_log
            filter:
              or_filter:
                filters:
                  - status_code_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 400
                          runtime_key: access_log.access_error.status
                  - status_code_filter:
                      comparison:
                        op: EQ
                        value:
                          default_value: 0
                          runtime_key: access_log.access_error.status
                  {% if mapping.get('log_high_latency_requests', True) %}
                  - duration_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 2000
                          runtime_key: access_log.access_error.duration
                  {% endif %}
            config:
              path: "/var/log/envoy/egress_{{ mapping['name'] }}_http_error.log"
              {% if mapping.get('is_amzn_service', False) -%}
              {{ access_log_helper.egress_error_amazon_service()|indent(10) }}
              {% else -%}
              {{ access_log_helper.egress_error_log()|indent(10) }}
              {% endif %}
  {% if (mongos_servers|length > 0) or (mongos_servers|length == 0 and not loop.last ) %}{% endif -%}
  {% endfor -%}
  {% for key, value in mongos_servers.iteritems() -%}
  - name : "{{ value['address'] }}"
    address:
      socket_address:
        address: "{{ value['address'] }}"
        protocol: TCP
        port_value: 9003
    filter_chains:
    - filters:
      - name: envoy.tcp_proxy
        config:
          stat_prefix: mongo_{{ key }}
          cluster: mongo_{{ key }}
      - name: envoy.mongo_proxy
        config:
          stat_prefix: "{{ key }}"
          access_log: "/var/log/envoy/mongo_{{ key }}.log"
      {% if value.get('ratelimit', False) %}
      - name: envoy.ratelimit
        config:
          stat_prefix: "{{ key }}"
          domain: envoy_mongo_cps
          descriptors:
            entries:
            - key: database
              value: "{{ key }}"
      {% endif %}
  {% endfor -%}
  clusters:
  {% for service, options in internal_virtual_hosts.iteritems() -%}
  - {{ helper.internal_cluster_definition(service, options)|indent(2)}}
  {% endfor -%}
  {% for mapping in external_virtual_hosts -%}
  {% for host in mapping['hosts'] -%}
  - name: egress_{{ host['name'] }}
    {% if host.get('ssl', False) %}
    tls_context:
      common_tls_context:
        validation_context:
          trusted_ca:
            filename: certs/cacert.pem
          {% if host.get('verify_subject_alt_name', False) %}
          verify_subject_alt_name: "{{host['verify_subject_alt_name'] }}"
          {% endif %}
      {% if host.get('sni', False) %}
      sni: "{{ host['sni'] }}"
      {% endif %}
    connect_timeout: 1s
    {% else %}
    connect_timeout: 0.25s
    {% endif %}
    type: LOGICAL_DNS
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        address: {{ host['remote_address'] }}
        port_value: {{ host['port_value'] }}
        protocol: {{ host['protocol'] }}
  {% endfor -%}
  {% endfor -%}
  {% for key, value in mongos_servers.iteritems() -%}
  - name: mongo_{{ key }}
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: RANDOM
    hosts:
    {% for server in value['hosts'] -%}
    - socket_address:
        protocol: {{ server['protocol'] }}
        port_value: {{ server['port_value'] }}
        address: {{ server['address'] }}
    {% endfor -%}
  {% endfor %}
  - name: main_website
    connect_timeout: 0.25s
    type: LOGICAL_DNS
    # Comment out the following line to test on v6 networks
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        address: main_website.com
        port_value: 443
    tls_context: { sni: www.main_website.com }
  - name: local_service
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        protocol: TCP
        address: 127.0.0.1
        port_value: 8080
    circuit_breakers:
      thresholds:
        max_pending_requests: 30
        max_connections: 100
  - name: local_service_grpc
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    http2_protocol_options: {}
    hosts:
    - socket_address:
        protocol: TCP
        address: 127.0.0.1
        port_value: 8081
    circuit_breakers:
      thresholds:
        max_requests: 200
    dns_lookup_family: V4_ONLY
  - name: rds
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        protocol: TCP
        address: rds.yourcompany.net
        port_value: 80
    dns_lookup_family: V4_ONLY
  - name: statsd
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        protocol: TCP
        address: 127.0.0.1
        port_value: 8125
    dns_lookup_family: V4_ONLY
  - name: lightstep_saas
    connect_timeout: 1s
    type: LOGICAL_DNS
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        protocol: TCP
        address: collector-grpc.lightstep.com
        port_value: 443
    http2_protocol_options:
      max_concurrent_streams: 100
    tls_context:
      common_tls_context:
        validation_context:
          trusted_ca:
            filename: certs/cacert.pem
          verify_subject_alt_name:
          - collector-grpc.lightstep.com
  - name: cds_cluster
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        protocol: TCP
        address: cds.yourcompany.net
        port_value: 80
  - name: sds
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        protocol: TCP
        address: discovery.yourcompany.net
        port_value: 80
dynamic_resources:
  cds_config:
    api_config_source:
      cluster_names:
      - cds_cluster
      refresh_delay: 30s
cluster_manager: {}
flags_path: "/etc/envoy/flags"
stats_sinks:
  - name: envoy.statsd
    config:
      tcp_cluster_name: statsd
watchdog: {}
tracing:
  http:
    name: envoy.lightstep
    config:
      access_token_file: "/etc/envoy/lightstep_access_token"
      collector_cluster: lightstep_saas
rate_limit_service:
  grpc_service:
    envoy_grpc:
      cluster_name: ratelimit
runtime:
  symlink_root: "/srv/runtime_data/current"
  subdirectory: envoy
  override_subdirectory: envoy_override
admin:
  access_log_path: /var/log/envoy/admin_access.log
  address:
    socket_address:
      protocol: TCP
      address: 0.0.0.0
      port_value: 9901