envoy.yaml

admin:
  access_log_path: "/tmp/admin_access.log"
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }

cluster_manager:
  outlier_detection:
    event_log_path: "/dev/stdout"

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 10000 }
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          access_log:
          - name: envoy.file_access_log
            config:
              path: "/tmp/access.log"
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              # routing
              routes:
              - match:
                  prefix: "/"
                route: { host_rewrite: httpbin.org, cluster: service }
          http_filters:
          - name: envoy.filters.http.jwt_authn
            config:
              providers:
                jwt_provider:
                  issuer: test
                  local_jwks:
                    inline_string: "{\"keys\":[{\"use\": \"sig\",\"alg\": \"RS256\",\"kid\": \"test\",\"kty\": \"RSA\",\"n\": \"4f5wg5l2hKsTeNem_V41fGnJm6gOdrj8ym3rFkEU_wT8RDtnSgFEZOQpHEgQ7JL38xUfU0Y3g6aYw9QT0hJ7mCpz9Er5qLaMXJwZxzHzAahlfA0icqabvJOMvQtzD6uQv6wPEyZtDTWiQi9AXwBpHssPnpYGIn20ZZuNlX2BrClciHhCPUIIZOQn_MmqTD31jSyjoQoV7MhhMTATKJx2XrHhR-1DcKJzQBSTAGnpYVaqpsARap-nwRipr3nUTuxyGohBTSmjJ2usSeQXHI3bODIRe1AuTyHceAbewn8b462yEWKARdpd9AjQW5SIVPfdsz5B6GlYQ5LdYKtznTuy7w\",\"e\": \"AQAB\"}]}"
                  forward: true
                  forward_payload_header: "plain-authorization"
              rules:
              - match:
                  prefix: /
                requires:
                  provider_and_audiences:
                    provider_name: jwt_provider
                    audiences:
                      books.read
          - name: envoy.router
  clusters:
  - name: service
    common_lb_config:
      healthy_panic_threshold:
        value: 0.0
    connect_timeout: 0.25s
    type: STRICT_DNS
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    hosts: [{ socket_address: { address: httpbin.org, port_value: 80 }}]