Envoy config (Cloud Run playground)

.gitlab-ci.yml

image: docker:19.03.12

variables:
  APPLICATION_NAME: envoy-front-proxy
  GCP_REGION: us-central1

services:
  - docker:19.03.12-dind

stages:
  - deploy

deploy-prod:
  stage: deploy
  image: google/cloud-sdk
  script:
    - echo $GCP_SERVICE_KEY > creds.json
    - gcloud auth activate-service-account --key-file creds.json
    - gcloud config set project $GCP_PROJECT_ID
    - gcloud run deploy --source . --region $GCP_REGION $APPLICATION_NAME

docker-compose.yml

version: '3'
services:
  envoy:
    image: envoyproxy/envoy-dev:latest
    ports:
      - "10000:10000"
      - "9901:9901"
    volumes:
      - ./envoy.yaml:/etc/envoy/envoy.yaml

Dockerfile

FROM envoyproxy/envoy-dev:latest
COPY envoy.yaml /etc/envoy/envoy.yaml
RUN chmod go+r /etc/envoy/envoy.yaml

envoy.yaml

admin:
  address:
    socket_address:
      protocol: TCP
      address: 0.0.0.0
      port_value: 9901
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        protocol: TCP
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          scheme_header_transformation:
            scheme_to_overwrite: https
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/users"
                route:
                #  host_rewrite_literal: awesome_url.com
                  prefix_rewrite: "/"
                  cluster: user_service
              - match:
                  prefix: "/sample"
                route:
#                  host_rewrite_literal: awesome_url.com
                  prefix_rewrite: "/"
                  auto_host_rewrite: true
                  cluster: cloud_run_sample
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: user_service
    connect_timeout: 30s
    type: LOGICAL_DNS
    # Comment out the following line to test on v6 networks
#    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    http2_protocol_options: { }
    load_assignment:
      cluster_name: user_service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: my-http-address.com
                port_value: 443
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: my-http-address.com
        common_tls_context:
          validation_context:
            match_subject_alt_names:
            - exact: "my-http-address.com"
            trusted_ca:
              filename: /etc/ssl/certs/ca-certificates.crt
  - name: cloud_run_sample
    connect_timeout: 30s
    type: STRICT_DNS
    # Comment out the following line to test on v6 networks
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    http2_protocol_options: { }
    load_assignment:
      cluster_name: cloud_run_sample
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: my-http-address.com
                port_value: 443
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: user-service.infinitus.ng
#        common_tls_context:
#          validation_context:
#            match_subject_alt_names:
#            - exact: "*.cloud-run-sample-6sgyzyaqla-uc.a.run.app"
#            trusted_ca:
#              filename: /etc/ssl/certs/ca-certificates.crt