Configuring Envoy proxy deployments

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

clusters:
  - name: sigsci-agent-grpc
    connect_timeout: 0.2s
    type: strict_dns
    #lb_policy: LEAST_REQUEST
    http2_protocol_options: {}
    #tls_context: {}
    ### You can also use 'hosts' below, but this is deprecated
    load_assignment:
      cluster_name: sigsci-agent-grpc
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: sigsci-agent
                port_value: 8000

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

http_filters:
- name: envoy.filters.http.ext_authz
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
    transport_api_version: V3
    grpc_service:
        envoy_grpc:
            cluster_name: sigsci-agent-grpc
        timeout: 0.2s
    failure_mode_allow: true
    with_request_body:
      # Maximum request body bytes buffered and sent to the sigsci-agent
      max_request_bytes: 8192
      # NOTE: If allow_partial_message is set false, then any request over
      # the above max bytes will fail with an HTTP "413 Payload Too Large"
      # so it is recommended to set this to true.
      allow_partial_message: true
      # NOTE: By default, envoy carries the HTTP request body as a UTF-8 string
      # and it fills the body @ # field. To pack the request body as raw bytes,
      # set pack_as_bytes to true.
      pack_as_bytes: true
- name: envoy.filters.http.router
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

access_log:
- name: envoy.http_grpc_access_log
   typed_config:
    "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
    common_config:
      log_name: "sigsci-agent-grpc"
      transport_api_version: V3
      grpc_service:
        envoy_grpc:
          cluster_name: sigsci-agent-grpc
        timeout: 0.2s
    additional_request_headers_to_log:
    # These sigsci-agent headers are required for correct processing:
    - "x-sigsci-request-id"
    - "x-sigsci-waf-response"
    # Optionally, additional headers can be added that should be recorded:
    - "accept"
    - "content-type"
    - "content-length"
    additional_response_headers_to_log:
    - "date"
    - "server"
    - "content-type"
    - "content-length"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

http_filters:
          - name: envoy.lua
            config:
              inline_code: |
                -- Add a special header to pass the encoded body
                function envoy_on_request(req)
                  local len = 0
                  local reqbody
                  -- Determine the body length
                  local cl = req:headers():get("content-length")
                  if cl ~= nil then
                    len = tonumber(cl)
                  end
                  -- gRPC does not have a content-length header to limit the body before buffering
                  if len == 0 and req:headers():get("content-type") == "application/grpc" then
                    -- Triggers buffering
                    len = req:body():length()
                  end
                  -- Limit body length sent to the agent (adjust as needed)
                  if len > 0 and len <= 8192 then
                    -- Triggers buffering
                    reqbody = req:body():getBytes(0, len)
                    -- Encode the body for use in a header value
                    local enc, t = string.gsub(reqbody, "[^%w]", function(chr)
                      return string.format("%%%02X",string.byte(chr))
                    end)
                    req:headers():add("x-sigsci-encoded-body", enc)
                  end
                end
          - name: envoy.ext_authz
            config:
              grpc_service:
                envoy_grpc:
                  cluster_name: sigsci-agent-grpc
                timeout: 0.2s
              failure_mode_allow: true
#              with_request_body:
#                max_request_bytes: 8192
#                allow_partial_message: true
          - name: envoy.router
            config: {}

1
2
3
4
5
6
7
8
9

additional_request_headers_to_log:
# These sigsci-agent headers are required for correct processing:
- "x-sigsci-request-id"
- "x-sigsci-waf-response"
# Optionally, additional headers can be added that should be recorded:
- "accept"
- "content-type"
- "content-length"
- "x-real-ip"

1
2
3
4
5

additional_response_headers_to_log:
- "date"
- "server"
- "content-type"
- "content-length"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199

# ConfigMap: Contains the Envoy configuration with ext_authz integration.
apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-config
data:
  envoy.yaml: |
    node:
      id: proxy-node
      cluster: proxy-cluster
    static_resources:
      listeners:
      - name: listener_0
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 10000
        filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                  - name: backend
                    domains: ["*"]
                    routes:
                    - match:
                        prefix: "/"
                      route:
                        cluster: edge_cluster
                        host_rewrite_literal: "http.edgecompute.app"
                    cors:
                      allow_origin_string_match:
                        - prefix: "*"
                      allow_methods: GET, PUT, DELETE, POST, OPTIONS
                      allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout
                      max_age: "1728000"
                      expose_headers: custom-header-1,grpc-status,grpc-message

                access_log:
                - name: envoy.access_loggers.stdout
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
                - name: envoy.http_grpc_access_log
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
                    common_config:
                      log_name: "sigsci-agent-grpc"
                      transport_api_version: V3
                      grpc_service:
                        envoy_grpc:
                          cluster_name: sigsci-agent-grpc
                        timeout: 0.2s
                    additional_request_headers_to_log:
                    # These sigsci-agent headers are required for correct processing:
                    - "x-sigsci-request-id"
                    - "x-sigsci-waf-response"
                    # Optionally, additional headers can be added that should be recorded:
                    - "accept"
                    - "content-type"
                    - "content-length"
                    additional_response_headers_to_log:
                    - "date"
                    - "server"
                    - "content-type"
                    - "content-length"


                http_filters:
                # ext_authz filter calls the NGWAF agent via gRPC.
                - name: envoy.filters.http.ext_authz
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                    transport_api_version: V3
                    grpc_service:
                      envoy_grpc:
                        cluster_name: sigsci-agent-grpc
                    failure_mode_allow: false
                - name: envoy.filters.http.router
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
      clusters:
      # Cluster for forwarding requests to https://http.edgecompute.app.
      - name: edge_cluster
        connect_timeout: 0.25s
        type: LOGICAL_DNS
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: edge_cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: http.edgecompute.app
                    port_value: 443
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
            sni: "http.edgecompute.app"
      # Cluster used by the ext_authz filter to contact the NGWAF agent.
      - name: sigsci-agent-grpc
        connect_timeout: 0.25s
        type: STATIC
        lb_policy: ROUND_ROBIN
        http2_protocol_options: {}  # <--- This tells Envoy to use HTTP/2 for gRPC
        load_assignment:
          cluster_name: sigsci-agent-grpc
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    # Both containers share the same network namespace.
                    address: 127.0.0.1
                    port_value: 9999

---

# Deployment: Combines the Envoy proxy and the Next‑Gen WAF Agent sidecar.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: envoy-waf-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: envoy-waf
  template:
    metadata:
      labels:
        app: envoy-waf
    spec:
      containers:
      # Envoy container – set to use debug logging for detailed output.
      - name: envoy
        image: envoyproxy/envoy:v1.22-latest
        args:
          - "-c"
          - "/etc/envoy/envoy.yaml"
          - "-l"
          - "debug"    # Change to "trace" for even more verbosity.
        ports:
        - containerPort: 10000
        volumeMounts:
        - name: envoy-config
          mountPath: /etc/envoy
      # Next‑Gen WAF Agent container (sigsci-agent) configured for ext_authz (gRPC mode).
      - name: sigsci-agent
        image: signalsciences/sigsci-agent:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: SIGSCI_ACCESSKEYID
          valueFrom:
            secretKeyRef:
              name: sigsci.my-site-name-here
              key: accesskeyid
        - name: SIGSCI_SECRETACCESSKEY
          valueFrom:
            secretKeyRef:
              name: sigsci.my-site-name-here
              key: secretaccesskey
        # Instruct the agent to expect response data and configure its gRPC address.
        - name: SIGSCI_ENVOY_EXPECT_RESPONSE_DATA
          value: "1"
        - name: SIGSCI_ENVOY_GRPC_ADDRESS
          value: "localhost:9999"
        - name: SIGSCI_DEBUG_ALL_THE_THINGS
          value: "true"
        - name: SIGSCI_WAF_DATA_LOG
          value: "/dev/stdout"
        ports:
        - containerPort: 9999
        securityContext:
          readOnlyRootFilesystem: true
      volumes:
      - name: envoy-config
        configMap:
          name: envoy-config

---

# Service: Exposes the Envoy listener on port 10000.
apiVersion: v1
kind: Service
metadata:
  name: envoy
spec:
  selector:
    app: envoy-waf
  ports:
  - protocol: TCP
    port: 10000
    targetPort: 10000