configmaps.yaml

{{- /* Define the Envoy configuration in YAML at the top level */}}
{{- /* (it will be used only if envoy.external_config.load_from_configmap is false) */}}
{{- define "envoy.configuration.yaml" }}
{{- with . }}
admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
      address: 0.0.0.0
      port_value: {{ .envoyAdminPort }}
static_resources:
  listeners:
    - name: listener_grpc
      address:
        socket_address:
          address: 0.0.0.0
          port_value: {{ .envoyGrpcPort }}
      {{- with .envoy.rate_limiter.listener_level }}
      {{- if .enabled }}
      listener_filters:
        - name: envoy.filters.listener.local_ratelimit
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.listener.local_ratelimit.v3.LocalRateLimit
            stat_prefix: local_rate_limiter
            token_bucket:
              max_tokens: {{ .max_tokens }}
              tokens_per_fill: {{ .tokens_per_fill }}
              fill_interval: {{ .fill_interval }}
      {{- end }}
      {{- end }}
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                generate_request_id: true
                {{- if (index .root.Values "opentelemetry-collector" "enabled") }}
                tracing:
                  random_sampling:
                    value: {{ mulf .envoy.tracing_sampling_rate 100 }}
                  provider:
                    name: envoy.tracers.opentelemetry
                    typed_config:
                      "@type": type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig
                      service_name: "${POD_NAME}"
                      grpc_service:
                        envoy_grpc:
                          cluster_name: opentelemetry_collector
                        timeout: 0.250s
                {{- end }}
                stat_prefix: ingress_grpc
                codec_type: AUTO
                route_config:
                  name: local_route_grpc
                  virtual_hosts:
                    - name: backend_grpc
                      domains: ["*"]
                      routes:
                        - match:
                            prefix: "/"
                          route:
                            cluster: triton_grpc_service
                            timeout: {{ .envoy.grpc_route_timeout }}
                http_filters:
                  {{- with .envoy.rate_limiter.prometheus_based }}
                  {{- if .enabled }}
                  - name: envoy.filters.http.lua
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                      default_source_code:
                        filename: /etc/envoy/lua/envoy-filter.lua
                  {{- end }}
                  {{- end }}

                  {{- with .envoy.auth }}
                  {{- if .enabled }}
                  - name: envoy.filters.http.JwtAuthentication
                    typed_config: 
                      "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
                      providers:
                        provider_icecube:
                          issuer: {{ .jwt_issuer }}
                          audiences: {{ .audiences }}
                          remote_jwks:
                            http_uri:
                              uri: {{ .jwt_remote_jwks_uri }}
                              cluster: auth_cluster
                              timeout: 100s
                            cache_duration:
                              seconds: 300
                      rules:
                      - match: 
                          prefix: /
                        requires: 
                          provider_name: provider_icecube
                  {{- end }}
                  {{- end }}
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
                http2_protocol_options: {}
  clusters:
    {{- with .envoy.rate_limiter.prometheus_based }}
    {{- if .enabled }}
    - name: prometheus_cluster
      connect_timeout: 5s
      type: LOGICAL_DNS
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: prometheus_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: {{ include "supersonic.prometheusHost" $.root }}
                      port_value: {{ include "supersonic.prometheusPort" $.root }}
      {{- if eq (include "supersonic.prometheusScheme" $.root) "https" }}
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
      {{- end }}
    {{- end }}
    {{- end }}

    {{- with .envoy.auth }}
    {{- if .enabled }}
    - name: auth_cluster
      type: STRICT_DNS
      connect_timeout: 500s
      load_assignment:
        cluster_name: auth_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: {{ .url }}
                      port_value: {{ .port }}
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    {{- end }}
    {{- end }}
    {{- if (index .root.Values "opentelemetry-collector" "enabled") }}
    - name: opentelemetry_collector
      type: STRICT_DNS
      lb_policy: ROUND_ROBIN
      typed_extension_protocol_options:
        envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
          "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
          explicit_http_config:
            http2_protocol_options: {}
      load_assignment:
        cluster_name: opentelemetry_collector
        endpoints:
        - lb_endpoints:
          - endpoint:
              address:
                socket_address:
                  address: {{ .root.Release.Name }}-opentelemetry-collector
                  port_value: 4317
    {{- end }}
    - name: triton_grpc_service
      connect_timeout: 0.25s
      type: STRICT_DNS
      lb_policy: {{ .envoy.loadBalancerPolicy }}
      http2_protocol_options: {}
      load_assignment:
        cluster_name: triton_grpc_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: {{ .tritonName }}
                      port_value: {{ .tritonGrpcPort }}
{{- end }}
{{- end }}

{{- /* Begin iterating over servers */}}
{{- if .Values.envoy.enabled }}

{{- /* Initialize envoyContext variable */}}
{{- $envoyContext := dict }}

{{- if not .Values.envoy.external_config.load_from_configmap }}
{{- /* Only prepare dynamic configuration context when not using external config */}}
{{- /* Define variables for ports */}}
{{- $tritonGrpcPort := "" -}}
{{- $envoyGrpcPort := "" -}}
{{- $envoyAdminPort := "" -}}
{{- range .Values.triton.service.ports }}
  {{- if eq .name "grpc" }}
    {{- $tritonGrpcPort = .port }}
  {{- end }}
{{- end }}
{{- range .Values.envoy.service.ports }}
  {{- if eq .name "grpc" }}
    {{- $envoyGrpcPort = .port }}
  {{- end }}
  {{- if eq .name "admin" }}
    {{- $envoyAdminPort = .port }}
  {{- end }}
{{- end }}
{{- $tritonName := include "supersonic.tritonName" . }}

{{- /* Create a context to pass to the template */}}
{{- $envoyContext = dict
    "envoyAdminPort" $envoyAdminPort
    "envoyGrpcPort" $envoyGrpcPort
    "tritonGrpcPort" $tritonGrpcPort
    "prometheus" .Values.prometheus
    "envoy" .Values.envoy
    "triton" .Values.triton
    "tritonName" $tritonName
    "root" .
}}
{{- end }}

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "supersonic.name" . }}-envoy-config
  labels:
    app.kubernetes.io/name: {{ .Chart.Name }}
    app.kubernetes.io/instance: {{ include "supersonic.name" . }}
    app.kubernetes.io/component: envoy
data:
  envoy.yaml: |-
{{- if .Values.envoy.external_config.load_from_configmap }}
    {{- if .Values.envoy.external_config.configmap_name }}
    {{- /* Load configuration from external ConfigMap */}}
    {{- $configmapName := .Values.envoy.external_config.configmap_name }}
    {{- $dataKey := .Values.envoy.external_config.configmap_key | default "envoy.yaml" }}
    {{- $externalConfig := (lookup "v1" "ConfigMap" .Release.Namespace $configmapName) }}
    {{- if $externalConfig }}
    {{- if $externalConfig.data }}
    {{- if hasKey $externalConfig.data $dataKey }}
    {{- /* Use the data from the external ConfigMap */}}
    {{- (get $externalConfig.data $dataKey) | nindent 4 }}
    {{- else }}
    {{- fail (printf "Expected key '%s' not found in ConfigMap '%s/%s'" $dataKey .Release.Namespace $configmapName) }}
    {{- end }}
    {{- else }}
    {{- fail (printf "No data found in ConfigMap '%s/%s'" .Release.Namespace $configmapName) }}
    {{- end }}
    {{- else }}
    {{- fail (printf "External ConfigMap '%s/%s' not found. Please ensure the ConfigMap exists." .Release.Namespace $configmapName) }}
    {{- end }}
    {{- else }}
    {{- /* Error if load_from_configmap is true but configmap_name is empty */}}
    {{- fail "envoy.external_config.configmap_name must be specified when envoy.external_config.load_from_configmap is true" }}
    {{- end }}
{{- else }}
{{- /* Use dynamically generated configuration */}}
{{ include "envoy.configuration.yaml" $envoyContext | indent 4 }}
{{- end }}
---

{{- if and .Values.envoy.rate_limiter.prometheus_based.enabled (not .Values.envoy.external_config.load_from_configmap) }}
{{- /* Create a ConfigMap for the Lua filter */}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "supersonic.name" . }}-lua-config
  labels:
    app.kubernetes.io/name: {{ .Chart.Name }}
    app.kubernetes.io/instance: {{ include "supersonic.name" . }}
    app.kubernetes.io/component: envoy
data:
  envoy-filter.lua: |-
    {{- /* Read and process the Lua configuration file */}}
    {{- $luaConfig := $.Files.Get .Values.envoy.rate_limiter.prometheus_based.luaConfig | nindent 4 }}
    {{- $luaConfig = $luaConfig | replace "SERVER_LOAD_METRIC" (include "supersonic.defaultMetric" . | quote) }}
    {{- $luaConfig = $luaConfig | replace "SERVER_LOAD_THRESHOLD" (quote .Values.serverLoadThreshold) }}
    {{- $luaConfig = $luaConfig | replace "PROMETHEUS_SCHEME" (include "supersonic.prometheusScheme" .) }}
    {{- $luaConfig = $luaConfig | replace "PROMETHEUS_HOST" (include "supersonic.prometheusHost" .) }}
    {{- $luaConfig = $luaConfig | replace "PROMETHEUS_PORT" (include "supersonic.prometheusPort" .) }}
    {{ $luaConfig | indent 4 }}

---
{{- end }}

{{- end }}