Envoy configuration

Envoy Configuration

In order to enable Callout Enforcer, the following changes to Envoy configuration are required:

1. adjust http_filters section
2. adjust clusters section

http_filters section

http_filters:
- name: envoy.filters.http.ext_proc
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
    grpc_service:
      envoy_grpc:
        cluster_name: px_callout_cluster
      timeout: 3s
    failure_mode_allow: false
    allow_mode_override: true
    message_timeout: 3s
    processing_mode:
      request_header_mode: "SEND"
      response_header_mode: "SEND"
      request_body_mode: "NONE"
      response_body_mode: "NONE"
      request_trailer_mode: "SKIP"
      response_trailer_mode: "SKIP"

Parameters description (Envoy documentation):

• grpcservice -> envoygrpc -> cluster_name: the name of "callout" cluster in clusters section
• grpcservice -> envoygrpc -> timeout: (recommended 1-5 seconds) The timeout for the gRPC request
• failure_mode_allow: By default, if the gRPC stream cannot be established, or if it is closed prematurely with an error, the filter will fail. Specifically, if the response headers have not yet been delivered, then it will return a 500 error downstream
• allow_mode_override: (required True) If allow_mode_override is set to true, the filter config processing_mode can be overridden by the response message from the external processing server mode_override.
• message_timeout: (recommended 1-5 seconds) Specifies the timeout for each individual message sent on the stream

Processing mode:

• request_header_mode: (required SEND) Control how request headers are handled
• response_header_mode: (required SEND) Control how response headers are handled
• request_body_mode: (required NONE) Control how the request body is handled
• response_body_mode: (required NONE) Control how the response body is handled
• request_trailer_mode: (required SKIP) Control how request trailers are handled
• response_trailer_mode: (required SKIP) Control how response trailers are handled

clusters section

clusters:
- name: px_callout_cluster
  type: STRICT_DNS
  lb_policy: ROUND_ROBIN
  connect_timeout: 1s
  http2_protocol_options: {}
  load_assignment:
    cluster_name: px_callout_cluster
    endpoints:
    - lb_endpoints:
      - endpoint:
          address:
            socket_address:
              address: 10.0.0.2
              port_value: 50051
  health_checks:
    - timeout: 10s
      interval: 10s
      unhealthy_threshold: 1
      healthy_threshold: 1
      reuse_connection: true
      tls_options:
        alpn_protocols: ["h2"]
      grpc_health_check:
        service_name: health_check
  transport_socket:
    name: envoy.transport_sockets.tls
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext

Parameters description (Envoy documentation):

• endpoints -> lb_endpoints -> endpoint -> address -> socket_address: (required) replace with the Callout Enforcer address
• health_checks: an optional section, can be ignored (see below "Health Check" paragraph)