apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: dikastes
  namespace: istio-system
spec:
  hosts:
    - dikastes.calico.cluster.local
  ports:
    - name: grpc
      protocol: grpc
      number: 1
  resolution: STATIC
  location: MESH_EXTERNAL
  endpoints:
    - address: unix:///var/run/dikastes/dikastes.sock
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: dikastes-mtls
  namespace: istio-system
spec:
  host: dikastes.calico.cluster.local
  trafficPolicy:
    tls:
      mode: DISABLE
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ext-authz
  namespace: istio-system
spec:
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.tcp_proxy
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.ext_authz
          config:
            stat_prefix: "dikastes"
            grpc_service:
              envoy_grpc:
                cluster_name: "outbound|1||dikastes.calico.cluster.local"
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.http_connection_manager
              subFilter:
                name: envoy.router
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.ext_authz
          config:
            grpc_service:
              envoy_grpc:
                cluster_name: "outbound|1||dikastes.calico.cluster.local"
