ec-backend.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ec-backend-envoy-config
  namespace: default
data:
  envoy.yaml: |
    admin:
      access_log_path: /var/log/envoy_admin_access.log
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 9901
    node:
      id: "id_01"
      cluster: "cluster_01"
    static_resources:
      listeners:
      - name: mtls-listener
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 8000
        filter_chains:
        - filters:
          - name: envoy.http_connection_manager
            config:
              idle_timeout: 1s
              forward_client_cert_details: sanitize_set
              set_current_client_cert_details:
                  uri: true
              codec_type: auto
              access_log:
              - name: envoy.file_access_log
                config:
                  path: "/var/log/envoy_access.log"
              stat_prefix: ingress_http
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: ec-backend
              http_filters:
              - name: envoy.ext_authz
                config:
                  failure_mode_allow: false
                  grpc_service:
                    google_grpc:
                      target_uri: 127.0.0.1:20000
                      stat_prefix: ext_authz
                    timeout: 0.5s
              - name: envoy.router
          tls_context:
            common_tls_context:
              tls_certificate_sds_secret_configs:
              - name: "spiffe://example.org/ec-backend"
                sds_config:
                  api_config_source:
                    api_type: GRPC
                    grpc_services:
                      envoy_grpc:
                        cluster_name: spire_agent
              combined_validation_context:
                default_validation_context:
                  verify_subject_alt_name:
                    - "spiffe://example.org/ec-web"
                    - "spiffe://example.org/news-web"
                validation_context_sds_secret_config:
                  name: "spiffe://example.org"
                  sds_config:
                    api_config_source:
                      api_type: GRPC
                      grpc_services:
                        envoy_grpc:
                          cluster_name: spire_agent
      clusters:
      - name: spire_agent
        connect_timeout: 0.25s
        http2_protocol_options: {}
        hosts:
          - pipe:
              path: /run/spire/sockets/agent.sock
      - name: ec-backend
        connect_timeout: 0.25s
        type: strict_dns
        lb_policy: ROUND_ROBIN
        hosts:
          - socket_address:
              address: 127.0.0.1
              port_value: 10000
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ec-backend-nginx-config
  namespace: default
data:
  default.conf: |
    server {
      listen 10000;
      server_name localhost;

      location = /data {
        return 200 "Hi ec-backend client!";
      }

      location = /admin {
        return 200 "Hi ec-backend administrator!";
      }
    }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ec-backend-opa-config
  namespace: default
data:
  config.yaml: |
    plugins:
      envoy_ext_authz_grpc:
        addr: :20000
        query: data.envoy.authz.allow
  policy.rego: |
    package envoy.authz

    import input.attributes.request.http as http_request
    import input.attributes.source.address as source_address

    default allow = false

    allow {
        http_request.path == "/data"
        http_request.method == "GET"
        svc_spiffe_id == "spiffe://example.org/ec-web"
    }

    svc_spiffe_id = client_id {
        [_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")
        [_, client_id] := split(uri_type_san, "=")
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ec-backend
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ec-backend
  template:
    metadata:
      labels:
        app: ec-backend
    spec:
      containers:
        - name: envoy
          image: envoyproxy/envoy:v1.12.2
          command: ["/usr/local/bin/envoy"]
          args: ["--config-path","/etc/envoy/envoy.yaml"]
          ports:
          - containerPort: 8000
          volumeMounts:
            - name: ec-backend-envoy-config
              mountPath: /etc/envoy
              readOnly: true
            - name: spire-agent-socket
              mountPath: /run/spire/sockets
              readOnly: true
        - name: ec-backend
          image: nginx:1.17.6
          ports:
          - containerPort: 10000
          volumeMounts:
            - name: ec-backend-nginx-config
              mountPath: /etc/nginx/conf.d
              readOnly: true
        - name: opa
          image: openpolicyagent/opa:0.15.1-istio
          args: ["run","--server","--config-file","/etc/opa/config.yaml","/etc/opa/policy.rego"]
          ports:
          - containerPort: 20000
          volumeMounts:
            - name: ec-backend-opa-config
              mountPath: /etc/opa
              readOnly: true
            - name: spire-agent-socket
              mountPath: /run/spire/sockets
              readOnly: true
      volumes:
        - name: ec-backend-envoy-config
          configMap:
            name: ec-backend-envoy-config
        - name: spire-agent-socket
          hostPath:
            path: /run/spire/sockets
            type: Directory
        - name: ec-backend-nginx-config
          configMap:
            name: ec-backend-nginx-config
        - name: ec-backend-opa-config
          configMap:
            name: ec-backend-opa-config
---
apiVersion: v1
kind: Service
metadata:
  name: ec-backend
  namespace: default
spec:
  type: NodePort
  ports:
    - name: envoy-port
      port: 8000
      targetPort: 8000
    - name: envoy-admin-port
      port: 9901
      targetPort: 9901
  selector:
    app: ec-backend