edge-tls.yaml-cicd-template

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 10000 }
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { cluster: ledger.<DOMAIN>_6865 }
          http_filters:
          - name: envoy.router
      tls_context:
        common_tls_context:
            alpn_protocols: "h2"
            tls_certificates:
            - certificate_chain: { filename: "/data/certs/server/certs/envoy.<DOMAIN>.cert.pem" }
              private_key: { filename: "/data/certs/server/private/envoy.<DOMAIN>.key.pem" }
  clusters:
  - name: ledger.<DOMAIN>_6865
    connect_timeout: 25s
    type: LOGICAL_DNS
    lb_policy: ROUND_ROBIN
    http2_protocol_options: { }
    load_assignment:
      cluster_name: ledger.<DOMAIN>_6865
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: <EDGE_TARGET>
                port_value: 6865
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        sni: ledger.<DOMAIN>
        common_tls_context: 
          tls_certificates:
            certificate_chain: { "filename": "/data/certs/client/client1.<DOMAIN>.cert.pem" }
            private_key: { "filename": "/data/certs/client/client1.<DOMAIN>.key.pem" }
          validation_context:
            match_subject_alt_names:
            - exact: "ledger.<DOMAIN>"
            trusted_ca:
              filename: /data/certs/intermediate/certs/ca-chain.cert.pem