envoy dynamic forward proxy configuration

envoy dynamic forward proxy 구성하기 위한 config.yaml

 

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
      protocol: TCP
      address: 127.0.0.1
      port_value: 9901
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        protocol: TCP
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/force-host-rewrite"
                route:
                  cluster: dynamic_forward_proxy_cluster
                per_filter_config:
                  envoy.filters.http.dynamic_forward_proxy:
                    host_rewrite: www.example.org
              - match:
                  prefix: "/"
                route:
                  cluster: dynamic_forward_proxy_cluster
          http_filters:
          - name: envoy.filters.http.dynamic_forward_proxy
            typed_config:
              "@type": type.googleapis.com/envoy.config.filter.http.dynamic_forward_proxy.v2alpha.FilterConfig
              dns_cache_config:
                name: dynamic_forward_proxy_cache_config
                dns_lookup_family: V4_ONLY
          - name: envoy.filters.http.router
  clusters:
  - name: dynamic_forward_proxy_cluster
    connect_timeout: 1s
    lb_policy: CLUSTER_PROVIDED
    cluster_type:
      name: envoy.clusters.dynamic_forward_proxy
      typed_config:
        "@type": type.googleapis.com/envoy.config.cluster.dynamic_forward_proxy.v2alpha.ClusterConfig
        dns_cache_config:
          name: dynamic_forward_proxy_cache_config
          dns_lookup_family: V4_ONLY
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
        common_tls_context:
          validation_context:
            trusted_ca: {filename: /etc/ssl/certs/ca-certificates.crt}

 

 

1. admin:
2. access_log_path: /tmp/admin_access.log
3. address:
4. socket_address:
5. protocol: TCP
6. address: 127.0.0.1
7. port_value: 9901
8. static_resources:
9. listeners:
10. - name: listener_0
11. address:
12. socket_address:
13. protocol: TCP
14. address: 0.0.0.0
15. port_value: 10000
16. filter_chains:
17. - filters:
18. - name: envoy.http_connection_manager
19. typed_config:
20. "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
21. stat_prefix: ingress_http
22. route_config:
23. name: local_route
24. virtual_hosts:
25. - name: local_service
26. domains: ["*"]
27. routes:
28. - match:
29. prefix: "/force-host-rewrite"
30. route:
31. cluster: dynamic_forward_proxy_cluster
32. per_filter_config:
33. envoy.filters.http.dynamic_forward_proxy:
34. host_rewrite: www.example.org
35. - match:
36. prefix: "/"
37. route:
38. cluster: dynamic_forward_proxy_cluster
39. http_filters:
40. - name: envoy.filters.http.dynamic_forward_proxy
41. config:
42. dns_cache_config:
43. name: dynamic_forward_proxy_cache_config
44. dns_lookup_family: V4_ONLY
45. - name: envoy.router
46. clusters:
47. - name: dynamic_forward_proxy_cluster
48. connect_timeout: 1s
49. lb_policy: CLUSTER_PROVIDED
50. cluster_type:
51. name: envoy.clusters.dynamic_forward_proxy
52. typed_config:
53. "@type": type.googleapis.com/envoy.config.cluster.dynamic_forward_proxy.v2alpha.ClusterConfig
54. dns_cache_config:
55. name: dynamic_forward_proxy_cache_config
56. dns_lookup_family: V4_ONLY
57. transport_socket:
58. name: envoy.transport_sockets.tls
59. typed_config:
60. "@type": type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
61. common_tls_context:
62. validation_context:
63. trusted_ca: {filename: /etc/ssl/certs/ca-certificates.crt}