node:
  cluster: usm-agent
  id: usm-agent_node

stats_config:
  stats_tags:
    - tag_name: hostname
      fixed_value: {{.Hostname}}

# Admin binds to 127.0.0.1 by default; configgen sets AdminAddress to ::1 when the env is IPv6-only.
admin:
  address:
    socket_address:
      address: "{{.AdminAddress}}"
      port_value: {{.AdminPort}}

static_resources:
  listeners:
  - name: monitoring_listener
    address:
      socket_address:
        protocol: TCP
        address: 0.0.0.0
        port_value: {{.MonitoringPort}}
{{- if .EnableIPv6DualStack}}
    additional_addresses:
      - address:
          socket_address:
            address: "::"
            port_value: {{.MonitoringPort}}
{{- end}}
    filter_chains:
      - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: monitoring
              route_config:
                name: monitoring_route
                virtual_hosts:
                  - name: monitoring_host
                    domains: ["*"]
                    routes:
                      - match:
                          prefix: "/stats/prometheus"
                        route:
                          cluster: envoy_admin
                      # Deny requests not matching the allowed paths
                      - match:
                          prefix: "/"
                        direct_response:
                          status: 404
                          body:
                            inline_string: "USM Agent: Not found"
              http_filters:
{{- if .DataPlaneBasicAuthEnabled}}
                # Prometheus BasicAuth configs mirror the DataPlane BasicAuth configs
                # This section enables basic authentication for downstream requests received from Prometheus.
                # Either basic authentication or mTLS authentication should be used, not both.
                - name: envoy.filters.http.basic_auth
                  config_discovery:
                    type_urls: ["type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth"]
                    config_source:
                      path_config_source:
                        path: {{.DataPlaneBasicAuthCredentialFile}}
                        watched_directory:
                          path: {{.DataPlaneBasicAuthCredentialDir}}
{{- end}}
                - name: envoy.filters.http.router
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
{{- if .DataPlaneTlsEnabled}}
        # Prometheus TLS configs mirror the DataPlane TLS configs
        # This section enables TLS for downstream requests received from Prometheus.
        # Enabling TLS is recommended when using basic authentication and is required to enable mTLS authentication
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
            common_tls_context:
              tls_certificate_sds_secret_configs:
                name: usm-agent_cert
                sds_config:
                  path_config_source:
                    path: {{.ConfigDir}}/usm-agent_cert.yaml
                    watched_directory:
                      path: {{.ConfigDir}}
  {{- if .DataPlaneClientAuthEnabled}}
              # Prometheus mTLS configs mirror the DataPlane mTLS configs
              # This section and the next enable mTLS authentication for downstream requests received from CP components.
              # Either basic authentication or mTLS authentication should be used, not both.
              validation_context_sds_secret_config:
                name: cp_ca
                sds_config:
                  path_config_source:
                    path: {{.ConfigDir}}/cp_ca.yaml
                    watched_directory:
                      path: {{.ConfigDir}}
            require_client_certificate: true
  {{- end}}
{{- end}}
  - name: controlplane_listener
    address:
      socket_address:
        protocol: TCP
        address: 0.0.0.0
        port_value: {{.ControlPlanePort}}
{{- if .EnableIPv6DualStack}}
    additional_addresses:
      - address:
          socket_address:
            address: "::"
            port_value: {{.ControlPlanePort}}
{{- end}}
    filter_chains:
      - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: controlplane
              route_config:
                name: controlplane_route
                virtual_hosts:
                  - name: controlplane_host
                    domains: ["*"]
                    routes:
                      - match:
                          prefix: "/validz"
                        route:
                          cluster: ccloud
                          prefix_rewrite: "/mr/v1/validz"
                          auto_host_rewrite: true
                        request_headers_to_add:
                          - header:
                              key: "X-Confluent-EnvironmentId"
                              value: "{{.EnvironmentId}}"
                      # Deny requests not matching the allowed paths
                      - match:
                          prefix: "/"
                        direct_response:
                          status: 404
                          body:
                            inline_string: "USM Agent: Not found"
              http_filters:
                - name: envoy.filters.http.health_check
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
                    pass_through_mode: false
                    cluster_min_healthy_percentages:
                      ccloud:
                        value: 32.0     # Mark USM Agent as ready if at least 1 of the 3 FD hosts is healthy
                    headers:
                      - name: ":path"
                        string_match:
                          exact: "/readyz"
                      - name: ":method"
                        string_match:
                          exact: "GET"
                - name: envoy.filters.http.health_check
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
                    pass_through_mode: false
                    headers:
                      - name: ":path"
                        string_match:
                          exact: "/healthz"
                      - name: ":method"
                        string_match:
                          exact: "GET"
                # This section adds basic authentication credentials for upstream requests sent to CCloud
                - name: envoy.filters.http.credential_injector
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
                    overwrite: true
                    credential:
                      name: envoy.http.injected_credentials.generic
                      typed_config:
                        "@type": type.googleapis.com/envoy.extensions.http.injected_credentials.generic.v3.Generic
                        credential:
                          name: credential
                          sds_config:
                            path_config_source:
                              path: {{.CCloudBasicAuthCredentialFile}}
                              watched_directory:
                                path: {{.CCloudBasicAuthCredentialDir}}
                - name: envoy.filters.http.router
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  - name: dataplane_listener
    address:
      socket_address:
        address: 0.0.0.0
        port_value: {{.DataPlanePort}}
{{- if .EnableIPv6DualStack}}
    additional_addresses:
      - address:
          socket_address:
            address: "::"
            port_value: {{.DataPlanePort}}
{{- end}}
    filter_chains:
      - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              stat_prefix: dataplane
              server_name: "usm-agent"
              access_log:
                - name: envoy.access_loggers.stdout
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
                    log_format:
                      text_format_source:
                        inline_string: |
                          [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS_LONG% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%" "%UPSTREAM_PROTOCOL%"
              route_config:
                name: dataplane_route
                #These headers are to be added before sending requests to Metadata Receiver or Telemetry Receiver
                request_headers_to_add:
                  - header:
                      key: "X-Confluent-EnvironmentId"
                      value: "{{.EnvironmentId}}"
                  - header:
                      key: "x-client-request-id"
                      value: "%REQ(x-request-id)%"
                    append_action: ADD_IF_ABSENT
                virtual_hosts:
                  - name: dataplane_host
                    domains: ["*"]
                    # Enables fully jittered exponential back-off beginning with 25ms capped to 250ms
                    retry_policy:
                      retry_on: connect-failure,gateway-error,refused-stream,reset
                      num_retries: 2
                      retry_back_off:
                        base_interval: 0.2s
                        max_interval: 1s
                    routes:
                      - match:
                          prefix: "/v1/events"
                        route:
                          timeout: {{.DataPlaneEventsRequestTimeoutSeconds}}s
                          auto_host_rewrite: true
                          cluster: ccloud
                          prefix_rewrite: "/mr/v1/events"
                      - match:
                          prefix: "/v1/metrics"
                        route:
                          timeout: {{.DataPlaneMetricsRequestTimeoutSeconds}}s
                          auto_host_rewrite: true
                          cluster: ccloud
                          prefix_rewrite: "/tr/v1/metrics"
                      # Deny requests not matching the allowed paths
                      - match:
                          prefix: "/"
                        direct_response:
                          status: 404
                          body:
                            inline_string: "USM Agent: Not found"
              http_filters:
{{- if .DataPlaneBasicAuthEnabled}}
                # This section enables basic authentication for downstream requests received from CP components.
                # Either basic authentication or mTLS authentication should be used, not both.
                - name: envoy.filters.http.basic_auth
                  config_discovery:
                    type_urls: ["type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth"]
                    config_source:
                      path_config_source:
                        path: {{.DataPlaneBasicAuthCredentialFile}}
                        watched_directory:
                          path: {{.DataPlaneBasicAuthCredentialDir}}
{{- end}}
                # This section adds basic authentication credentials for upstream requests sent to CCloud
                - name: envoy.filters.http.credential_injector
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
                    overwrite: true
                    credential:
                      name: envoy.http.injected_credentials.generic
                      typed_config:
                        "@type": type.googleapis.com/envoy.extensions.http.injected_credentials.generic.v3.Generic
                        credential:
                          name: credential
                          sds_config:
                            path_config_source:
                              path: {{.CCloudBasicAuthCredentialFile}}
                              watched_directory:
                                path: {{.CCloudBasicAuthCredentialDir}}
                - name: envoy.filters.http.tap
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.tap.v3.Tap
                    record_headers_received_time: true
                    record_downstream_connection: true
                    common_config:
                      admin_config:
                        config_id: traffic_tap
                - name: envoy.filters.http.router
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
{{- if .DataPlaneTlsEnabled}}
        # This section enables TLS for downstream requests received from CP components.
        # Enabling TLS is recommended when using basic authentication and is required to enable mTLS authentication
        transport_socket:
          name: envoy.transport_sockets.tls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
            common_tls_context:
              tls_certificate_sds_secret_configs:
                name: usm-agent_cert
                sds_config:
                  path_config_source:
                    path: {{.ConfigDir}}/usm-agent_cert.yaml
                    watched_directory:
                      path: {{.ConfigDir}}
  {{- if .DataPlaneClientAuthEnabled}}
              # This section and the next enable mTLS authentication for downstream requests received from CP components.
              # Either basic authentication or mTLS authentication should be used, not both.
              validation_context_sds_secret_config:
                name: cp_ca
                sds_config:
                  path_config_source:
                    path: {{.ConfigDir}}/cp_ca.yaml
                    watched_directory:
                      path: {{.ConfigDir}}
            require_client_certificate: true
  {{- end}}
{{- end}}
# Limits upstream requests to be sent only to the configured hosts
  clusters:
  - name: ccloud
    cluster_type:
      name: envoy.clusters.dns
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.clusters.dns.v3.DnsCluster
        all_addresses_in_single_endpoint: false
        dns_lookup_family: V4_PREFERRED
        dns_refresh_rate: {{.CCloudDnsRefreshRateSeconds}}s
    load_assignment:
      cluster_name: ccloud
      endpoints:
        - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: {{.CCloudHost}}
                    port_value: {{.CCloudPort}}
    health_checks:
    - timeout: {{.CCloudHealthcheckTimeoutSeconds}}s
      interval: {{.CCloudHealthcheckIntervalSeconds}}s
      interval_jitter: 2s
      initial_jitter: 2s
      no_traffic_interval: {{.CCloudHealthcheckIntervalSeconds}}s
      unhealthy_threshold: 2
      healthy_threshold: 1
      tcp_health_check: {}
      reuse_connection: true
    common_lb_config:
      healthy_panic_threshold:
        value: 32     # If less than 1 of the 3 FD hosts is healthy, panic and send requests to all hosts
    upstream_connection_options:
      tcp_keepalive:
        keepalive_probes: 3
        keepalive_time: 60
        keepalive_interval: 30
{{- if .CCloudTlsEnabled}}
    typed_extension_protocol_options:
      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
        "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
        auto_config: {}
        common_http_protocol_options:
          max_connection_duration: 7200s
          max_stream_duration: 300s
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        auto_host_sni: true
        auto_sni_san_validation: true
        common_tls_context:
          validation_context_sds_secret_config:
            name: validation_context_sds
            sds_config:
              path_config_source:
                path: {{.ConfigDir}}/ccloud_ca.yaml
                watched_directory:
                  path: {{.ConfigDir}}
{{- end}}
# Defines a cluster that connects to envoy's local admin interface
  - name: envoy_admin
    type: STATIC
    load_assignment:
      cluster_name: envoy_admin
      endpoints:
        - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: "{{.AdminAddress}}"
                    port_value: {{.AdminPort}}
