# You must define a node and cluster ID to use xDS discovery
node: { id: "envoynode", cluster: "envoycluster" }
# The CDS discovery service references a cluster defined as “xds_service” below
dynamic_resources:
  cds_config:
     api_config_source:
       api_type: GRPC
       grpc_services:
        envoy_grpc: { cluster_name: xds_service }
# The static resources define the location of the xDS server and the port to listen to.static_resources:
static_resources:
  clusters:
  - name: xds_service
    connect_timeout: 0.25s
    http2_protocol_options: {}
    type: static
    # If you run the Deephaven web_api_service on a different machine or port, you must change this configuration.
    hosts: [{socket_address: { address: 127.0.0.1, port_value: 8124 } }]
  listeners:
  - address:
      socket_address:
        address: 0.0.0.0
        port_value: 443
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          codec_type: AUTO
          stat_prefix: egress_http
          upgrade_configs:
          - upgrade_type: websocket
          rds:
            config_source:
               api_config_source:
                 api_type: GRPC
                 grpc_services:
                   envoy_grpc:
                     cluster_name: "xds_service"
            route_config_name: rds_config
          access_log:
          # You may choose to write an access log to record requests to Envoy. See the Envoy documentation for
          # defining filters based on HTTP status codes or request duration.
          - name: envoy.file_access_log
            typed_config:
              "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
              path: "/tmp/envoy-access.log"
          http_filters:
          - name: envoy.router
            typed_config: {}
    # To listen with TLS, you must define the paths to your certificate and key .pem files. If you do not
    # define a tls_context,then Envoy will listen with HTTP instead of HTTPS.
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext
          common_tls_context:
            tls_certificates:
              certificate_chain:
                filename: "/etc/ssl/certs/envoy.crt"
              private_key:
                filename: "/etc/ssl/private/envoy.key"
# Running an admin server allows you to debug Envoy’s xDS by connecting to port 8001 with a web browser and
# visiting the “config_dump page.
admin:
  access_log_path: "/tmp/envoy-admin.log"
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 8001