{
  "transport_socket_matches": [],传输socket匹配配置
  "name": "...",cluster名称，route引用时会用到
  "alt_stat_name": "...",stat的cluste名称
  "type": "...",集群类型
  "cluster_type": "{...}",自定义cluster类型
  "eds_cluster_config": "{...}",eds获取endpoint集群配置
  "connect_timeout": "{...}",连接超时时间
  "per_connection_buffer_limit_bytes": "{...}",每个连接缓存限值
  "lb_policy": "...",负载均衡策略
  "load_assignment": "{...}",端点信息配置
  "health_checks": [],健康检查配置
  "max_requests_per_connection": "{...}",每个连接最大请求数量
  "circuit_breakers": "{...}",连接池配置
  "upstream_http_protocol_options": "{...}",上游http协议选项
  "common_http_protocol_options": "{...}",共性http协议参数
  "http_protocol_options": "{...}",http1.1参数
  "http2_protocol_options": "{...}",http2参数
  "typed_extension_protocol_options": "{...}",扩展协议选项
  "dns_refresh_rate": "{...}",dns刷新频率
  "dns_failure_refresh_rate": "{...}",dns失败刷新频率
  "respect_dns_ttl": "...",dns刷新频率写入ttl
  "dns_lookup_family": "...",dns查找ip类型
  "dns_resolvers": [],已废弃
  "use_tcp_for_dns_lookups": "...",dns查找时用tcp协议
  "dns_resolution_config": "{...}",dns服务器，及参数配置
  "wait_for_warm_on_init": "{...}",等待warm-up完成
  "outlier_detection": "{...}",断路器配置
  "cleanup_interval": "{...}",过期的hosts清理间隔，默认5000ms，ORIGINAL_DST生效
  "upstream_bind_config": "{...}",绑定新连接的上游连接配置
  "lb_subset_config": "{...}",子集路由配置
  "ring_hash_lb_config": "{...}",一致性hash负载均衡配置
  "maglev_lb_config": "{...}",Maglev 负载均衡配置
  "original_dst_lb_config": "{...}",original_dst负载均衡配置
  "least_request_lb_config": "{...}",最少请求负载均衡配置
  "round_robin_lb_config": "{...}",轮训负载均衡配置
  "common_lb_config": "{...}",共性负载均衡配置
  "transport_socket": "{...}",传输socket配置
  "metadata": "{...}",元数据设置
  "protocol_selection": "...",已废弃
  "upstream_connection_options": "{...}",上游连接选项
  "close_connections_on_host_health_failure": "...",当host不健康时关闭连接
  "ignore_health_on_host_removal": "...",当host删除时忽略健康状态
  "filters": [],network filter chain
  "load_balancing_policy": "{...}",负载均衡策略配置
  "track_timeout_budgets": "...",已废弃
  "upstream_config": "{...}",配置上游连接值和上游类型
  "track_cluster_stats": "{...}",跟踪cluster状态配置
  "preconnect_policy": "{...}",预连接配置
  "connection_pool_per_downstream_connection": "..."每个下游连接使用一个连接池
}

{
  "name": "...",名称
  "match": "{...}",匹配条件
  "transport_socket": "{...}"传输socket配置
}

{
  "name": "...",名称
  "typed_config": "{...}"配置
}

{
  "eds_config": "{...}",eds来源配置
  "service_name": "..."服务名称
}

{
  "cluster_name": "...",cluster名称
  "endpoints": [],端点配置
  "policy": "{...}"策略配置
}

{
  "locality": "{...}",位置信息
  "lb_endpoints": [],端点
  "load_balancer_endpoints": "{...}",端点
  "leds_cluster_locality_config": "{...}",位置配置
  "load_balancing_weight": "{...}",负载均衡权重
  "priority": "..."优先级
}

{
  "endpoint": "{...}",端点信息
  "health_status": "...",健康状态
  "metadata": "{...}",元数据信息
  "load_balancing_weight": "{...}"负载均衡权重
}

{
  "address": "{...}",地址
  "health_check_config": "{...}",健康检查配置
  "hostname": "..."主机名
}

{
  "overprovisioning_factor": "{...}",优先级和位置端点被认为是overprovisioning的因子
  "endpoint_stale_after": "{...}"端点可以使用的最大时间，超过这个时间没有新的端点被认为是过期的
}

{
  "timeout": "{...}",健康检查超时时间
  "interval": "{...}",周期
  "initial_jitter": "{...}",初始抖动
  "interval_jitter": "{...}",周期性抖动
  "interval_jitter_percent": "...",周期性抖动百分比
  "unhealthy_threshold": "{...}",不健康次数限值
  "healthy_threshold": "{...}",健康次数限值
  "reuse_connection": "{...}",重用健康检查的连接
  "http_health_check": "{...}",http类型的健康检查
  "tcp_health_check": "{...}",tcp类型的健康检查
  "grpc_health_check": "{...}",grpc类型的健康检查
  "custom_health_check": "{...}",自定义类型的健康检查
  "no_traffic_interval": "{...}",没有流量的健康检查周期
  "no_traffic_healthy_interval": "{...}",健康节点的，没有流量的健康检查周期
  "unhealthy_interval": "{...}",不健康节点的，健康检查周期
  "unhealthy_edge_interval": "{...}",当节点不健康时，第一次健康检查的周期
  "healthy_edge_interval": "{...}",当节点健康时，第一次的健康检查周期
  "event_log_path": "...",健康检查事件日志路径
  "always_log_health_check_failures": "...",是否总是记录健康检查失败事件日志
  "tls_options": "{...}",覆盖tls选项
  "transport_socket_match_criteria": "{...}"匹配transport_socket_match的条件
}

{
  "host": "...",主机名
  "path": "...",路径
  "request_headers_to_add": [],添加请求头
  "request_headers_to_remove": [],删除请求头
  "expected_statuses": [],期望的状态码
  "retriable_statuses": [],可重试的状态码
  "codec_client_type": "...",客户端codec类型
  "service_name_matcher": "{...}"服务名称匹配
}

{
  "send": "{...}",16进制发送的消息
  "receive": []16进制接收的消息
}

{
  "service_name": "...",服务名称
  "authority": "...":authority头值
}

{
  "name": "...",名称
  "typed_config": "{...}"配置
}

{
  "priority": "...",路由优先级
  "max_connections": "{...}",最大连接数量，默认1024
  "max_pending_requests": "{...}",最大等待请求数量，默认1024
  "max_requests": "{...}",最大请求数量，默认1024
  "max_retries": "{...}",重大重试次数，默认3
  "retry_budget": "{...}",活跃连接百分比设置并发重试限值
  "track_remaining": "...",短路器打开前资源存量是否记录到stat
  "max_connection_pools": "{...}"最大连接池数量
}

{
  "auto_sni": "...",是否自动sni
  "auto_san_validation": "...",自动san校验
  "override_auto_sni_header": "..."覆盖sni头
}

{
  "idle_timeout": "{...}",空闲超时时间
  "max_connection_duration": "{...}",连接最大时间
  "max_headers_count": "{...}",最大头数量
  "max_stream_duration": "{...}",流最大时间
  "headers_with_underscores_action": "...",有下划线头处理动作
  "max_requests_per_connection": "{...}"每个连接最大请求数量
}

{
  "allow_absolute_url": "{...}",是否允许处理连接用完全的url
  "accept_http_10": "...",是否接受http1.0 0.9协议
  "default_host_for_http_10": "...",http1.0默认host
  "header_key_format": "{...}",header键格式
  "enable_trailers": "...",是否启用trailer
  "allow_chunked_length": "...",是否允许分块的长度
  "override_stream_error_on_invalid_http_message": "{...}"覆盖流错误当有错误的http消息时
}

{
  "hpack_table_size": "{...}",hpack头表大小
  "max_concurrent_streams": "{...}",最大并发流
  "initial_stream_window_size": "{...}",初始流窗口大小
  "initial_connection_window_size": "{...}",初始连接窗口大小
  "allow_connect": "...",是否允许升级的协议连接
  "max_outbound_frames": "{...}",最大出口帧
  "max_outbound_control_frames": "{...}",最大出口控制帧
  "max_consecutive_inbound_frames_with_empty_payload": "{...}",最大连续的入口帧当消息体是空时
  "max_inbound_priority_frames_per_stream": "{...}",每个流最大入口优先帧
  "max_inbound_window_update_frames_per_data_frame_sent": "{...}",每个数据帧发送的最大入口窗口更新帧
  "stream_error_on_invalid_http_messaging": "...",当http协议错误时，流错误
  "override_stream_error_on_invalid_http_message": "{...}",当http出错时覆盖流错误
  "connection_keepalive": "{...}"保持连接配置信息
}

{
  "consecutive_5xx": "{...}",最大连续5xx错误，默认5
  "interval": "{...}",异常检测间隔，默认10s
  "base_ejection_time": "{...}",弹出时间
  "max_ejection_percent": "{...}",最大弹出百分比
  "enforcing_consecutive_5xx": "{...}",连续5xx错误超出时弹出机率，默认100
  "enforcing_success_rate": "{...}",成功率探测超出时弹出几率，默认100
  "success_rate_minimum_hosts": "{...}",成功几率异常检测最小host数量
  "success_rate_request_volume": "{...}",最小请求数量，用成功率检测时
  "success_rate_stdev_factor": "{...}",成功率计算公式mean - (stdev * success_rate_stdev_factor). 默认1900
  "consecutive_gateway_failure": "{...}",连续gateway错误，弹出，默认5
  "enforcing_consecutive_gateway_failure": "{...}",连续网关错误弹出几率，默认0
  "split_external_local_origin_errors": "...",是否区分本地源错误和外部错误
  "consecutive_local_origin_failure": "{...}",连续本地错误触发弹出数值，默认5
  "enforcing_consecutive_local_origin_failure": "{...}",连续本地错误触发弹出的几率，默认100
  "enforcing_local_origin_success_rate": "{...}",本地错误成功率触发弹出几率，默认100
  "failure_percentage_threshold": "{...}",错误百分比触发弹出，默认85
  "enforcing_failure_percentage": "{...}",错误百分比达到限值弹出的几率，默认0
  "enforcing_failure_percentage_local_origin": "{...}",本地源错误百分比弹出几率，默认0
  "failure_percentage_minimum_hosts": "{...}",基于错误百分比的弹出的最小host数量，默认5
  "failure_percentage_request_volume": "{...}",基于错误百分比弹出的请求数量，默认50
  "max_ejection_time": "{...}"最大弹出时间，默认300s
}

{
  "fallback_policy": "...",没有endpoint匹配时的处理策略
  "default_subset": "{...}",没有endpoint匹配时的默认子集
  "subset_selectors": [],子集选择
  "locality_weight_aware": "...",是否感知位置
  "scale_locality_weight": "...",调整位置权重
  "panic_mode_any": "...",当回退策略设置没有选择端点时，匹配任何节点
  "list_as_any": "..."匹配metadata列表中的任意值
}

{
  "minimum_ring_size": "{...}",最小ring环大小
  "hash_function": "...",hash函数
  "maximum_ring_size": "{...}"最大ring环大小
}

{
  "table_size": "{...}"表大小，默认65537
}

{
  "use_http_header": "..."是否使用x-envoy-original-dst-host 头作为目标集群
}

{
  "choice_count": "{...}",最小连接的主机选择数量，默认2
  "active_request_bias": "{...}",weight = load_balancing_weight / (active_requests + 1)^active_request_bias
  "slow_start_config": "{...}"慢开始配置
}

{
  "slow_start_config": "{...}"慢开始配置
}

{
  "healthy_panic_threshold": "{...}",panic模式限值，默认 50%
  "zone_aware_lb_config": "{...}",区域感知负载均衡配置
  "locality_weighted_lb_config": "{...}",位置权重负载均衡配置
  "update_merge_window": "{...}",health check/weight/metadata更新合并，默认1s
  "ignore_new_hosts_until_first_hc": "...",忽略新主机知道他们第一次健康检测成功
  "close_connections_on_host_set_change": "...",当主机添加或删除时，drain 连接
  "consistent_hashing_lb_config": "{...}"一致性hash负载均衡配置
}

{
  "routing_enabled": "{...}",启用区域感知路由的请求比例，默认100%
  "min_cluster_size": "{...}",使用区域感知路由上游主机数量，默认6
  "fail_traffic_on_panic": "..."当panic模式时，请求连接失败
}

{
  "name": "...",名称
  "typed_config": "{...}"配置
}

{
  "filter_metadata": "{...}",元数据
  "typed_filter_metadata": "{...}"typed元数据
}

{
  "tcp_keepalive": "{...}"保持连接配置
}

{
  "name": "...",名称
  "typed_config": "{...}"配置
}

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster
  namespace: istio-system 
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: CLUSTER
    patch:
      operation: REPLACE
      value:
          circuitBreakers:
            thresholds:
            - maxConnections: 4294967295
              maxPendingRequests: 4294967295
              maxRequests: 4294967295
              maxRetries: 4294967295
              trackRemaining: true
          connectTimeout: 10s
          edsClusterConfig:
            edsConfig:
              ads: {}
              initialFetchTimeout: 0s
              resourceApiVersion: V3
            serviceName: outbound|9080||productpage.istio.svc.cluster.local
          filters:
          - name: istio.metadata_exchange
            typedConfig:
              '@type': type.googleapis.com/udpa.type.v1.TypedStruct
              typeUrl: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
          metadata:
            filterMetadata:
              istio:
                default_original_port: 9080
                services:
                - host: productpage.istio.svc.cluster.local
                  name: productpage
                  namespace: istio
          name: outbound|9080||productpage.istio.svc.cluster.local
          transportSocketMatches:
          - match:
              tlsMode: istio
            name: tlsMode-istio
            transportSocket:
              name: envoy.transport_sockets.tls
              typedConfig:
                '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
                commonTlsContext:
                  alpnProtocols:
                  - istio-peer-exchange
                  - istio
                  combinedValidationContext:
                    defaultValidationContext:
                      matchSubjectAltNames:
                      - exact: spiffe://cluster.local/ns/istio/sa/bookinfo-productpage
                    validationContextSdsSecretConfig:
                      name: ROOTCA
                      sdsConfig:
                        apiConfigSource:
                          apiType: GRPC
                          grpcServices:
                          - envoyGrpc:
                              clusterName: sds-grpc
                          setNodeOnFirstMessageOnly: true
                          transportApiVersion: V3
                        initialFetchTimeout: 0s
                        resourceApiVersion: V3
                  tlsCertificateSdsSecretConfigs:
                  - name: default
                    sdsConfig:
                      apiConfigSource:
                        apiType: GRPC
                        grpcServices:
                        - envoyGrpc:
                            clusterName: sds-grpc
                        setNodeOnFirstMessageOnly: true
                        transportApiVersion: V3
                      initialFetchTimeout: 0s
                      resourceApiVersion: V3
                sni: outbound_.9080_._.productpage.istio.svc.cluster.local
          - match: {}
            name: tlsMode-disabled
            transportSocket:
              name: envoy.transport_sockets.raw_buffer
          type: EDS

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: apply-to
  namespace: istio 
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: LISTENER
    match:
      context: SIDECAR_INBOUND
    patch:
      operation: ADD
      value:
        name: proxy
        address:
          socket_address:
            protocol: TCP
            address: 0.0.0.0
            port_value: 18081
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager  
              stat_prefix: ingress_http
              codec_type: AUTO
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route: 
                      cluster: service_httpbin               
              http_filters:
              - name: envoy.filters.http.router
          transport_socket:
            name: envoy.transport_sockets.alts
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.alts.v3.Alts
              handshaker_service: "169.254.169.254:8080"
              peer_service_accounts:
              - "alts-client@mineral-minutia-820.iam.gserviceaccount.com"
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value: 
            name: service_httpbin
            connect_timeout: 2s
            type: LOGICAL_DNS
            dns_lookup_family: V4_ONLY
            lb_policy: ROUND_ROBIN
            load_assignment:
              cluster_name: cert_service
              endpoints:
              - lb_endpoints:
                - endpoint:
                    address:
                      socket_address:
                        address: httpbin.org
                        port_value: 443
            transport_socket:
              name: envoy.transport_sockets.tls
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: apply-to
  namespace: istio 
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: LISTENER
    match:
      context: SIDECAR_OUTBOUND
    patch:
      operation: ADD
      value:
        name: proxy
        address:
          socket_address:
            protocol: TCP
            address: 0.0.0.0
            port_value: 18080
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager      
              stat_prefix: ingress_http
              codec_type: AUTO
              route_config:
                name: local_route
                virtual_hosts:
                - name: local_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: service_upstream           
              http_filters:
              - name: envoy.filters.http.router
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value: 
        name: service_upstream
        connect_timeout: 2s
        type: STRICT_DNS
        dns_lookup_family: V4_ONLY
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: cert_service        
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: alts-server
                    port_value: 18081        
        transport_socket:
          name: envoy.transport_sockets.alts
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.alts.v3.Alts
            handshaker_service: "169.254.169.254:8080"
            peer_service_accounts:
            - "alts-server@mineral-minutia-820.iam.gserviceaccount.com"

{
  "common_tls_context": "{...}",
  "require_client_certificate": "{...}",
  "session_ticket_keys": "{...}",
  "session_ticket_keys_sds_secret_config": "{...}",
  "disable_stateless_session_resumption": "...",
  "session_timeout": "{...}",
  "ocsp_staple_policy": "..."
}

{
  "common_tls_context": "{...}",
  "sni": "...",
  "allow_renegotiation": "...",
  "max_session_keys": "{...}"
}

{
  "tls_params": "{...}",
  "tls_certificates": [],
  "tls_certificate_sds_secret_configs": [],
  "validation_context": "{...}",
  "validation_context_sds_secret_config": "{...}",
  "combined_validation_context": "{...}",
  "alpn_protocols": [],
  "custom_handshaker": "{...}"
}

{
  "certificate_chain": "{...}",
  "private_key": "{...}",
  "watched_directory": "{...}",
  "private_key_provider": "{...}",
  "password": "{...}",
  "ocsp_staple": "{...}"
}

{
  "name": "...",
  "sds_config": "{...}"
}

{
  "trusted_ca": "{...}",
  "watched_directory": "{...}",
  "verify_certificate_spki": [],
  "verify_certificate_hash": [],
  "match_subject_alt_names": [],
  "crl": "{...}",
  "allow_expired_certificate": "...",
  "trust_chain_verification": "...",
  "custom_validator_config": "{...}"
}

{
  "name": "...",
  "sds_config": "{...}"
}

{
  "default_validation_context": "{...}",
  "validation_context_sds_secret_config": "{...}"
}

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster
  namespace: istio-system 
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: CLUSTER
    match:   
      cluster:
        name: outbound|9080||productpage.istio.svc.cluster.local
    patch:
      operation: REMOVE
  - applyTo: CLUSTER
    patch:
      operation: ADD     
      value:
          type: EDS
          circuitBreakers:
            thresholds:
            - maxConnections: 4294967295
              maxPendingRequests: 4294967295
              maxRequests: 4294967295
              maxRetries: 4294967295
              trackRemaining: true
          connectTimeout: 10s
          edsClusterConfig:
            edsConfig:
              ads: {}
              initialFetchTimeout: 0s
              resourceApiVersion: V3
            serviceName: outbound|9080||productpage.istio.svc.cluster.local
          filters:
          - name: istio.metadata_exchange
            typedConfig:
              '@type': type.googleapis.com/udpa.type.v1.TypedStruct
              typeUrl: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
          metadata:
            filterMetadata:
              istio:
                default_original_port: 9080
                services:
                - host: productpage.istio.svc.cluster.local
                  name: productpage
                  namespace: istio
          name: outbound|9080||productpage.istio.svc.cluster.local
          transportSocketMatches:
          - match: {}
            name: tlsMode-startTls
            transportSocket:
              name: envoy.transport_sockets.starttls
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig
                cleartext_socket_config: {}
                tls_socket_config:
                    common_tls_context:
                      combinedValidationContext:
                        defaultValidationContext:
                          matchSubjectAltNames:
                          - exact: spiffe://cluster.local/ns/istio/sa/bookinfo-productpage
                        validationContextSdsSecretConfig:
                          name: ROOTCA
                          sdsConfig:
                            apiConfigSource:
                              apiType: GRPC
                              grpcServices:
                              - envoyGrpc:
                                  clusterName: sds-grpc
                              setNodeOnFirstMessageOnly: true
                              transportApiVersion: V3
                            initialFetchTimeout: 0s
                            resourceApiVersion: V3
                      tlsCertificateSdsSecretConfigs:
                      - name: default
                        sdsConfig:
                          apiConfigSource:
                            apiType: GRPC
                            grpcServices:
                            - envoyGrpc:
                                clusterName: sds-grpc
                            setNodeOnFirstMessageOnly: true
                            transportApiVersion: V3
                          initialFetchTimeout: 0s
                          resourceApiVersion: V3
                    sni: outbound_.9080_._.productpage.istio.svc.cluster.local

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: FILTER_CHAIN
    match:
      listener:
        filterChain:
          transportProtocol: raw_buffer
          destinationPort: 9080
    patch:
      operation: MERGE
      value:
        transport_socket:
          name: envoy.transport_sockets.starttls
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig
            cleartext_socket_config: {}
            tls_socket_config:
                    require_client_certificate: true
                    common_tls_context:
                      combinedValidationContext:
                        defaultValidationContext:
                          matchSubjectAltNames:
                          - exact: spiffe://cluster.local/ns/istio/sa/bookinfo-productpage
                        validationContextSdsSecretConfig:
                          name: ROOTCA
                          sdsConfig:
                            apiConfigSource:
                              apiType: GRPC
                              grpcServices:
                              - envoyGrpc:
                                  clusterName: sds-grpc
                              setNodeOnFirstMessageOnly: true
                              transportApiVersion: V3
                            initialFetchTimeout: 0s
                            resourceApiVersion: V3
                      tlsCertificateSdsSecretConfigs:
                      - name: default
                        sdsConfig:
                          apiConfigSource:
                            apiType: GRPC
                            grpcServices:
                            - envoyGrpc:
                                clusterName: sds-grpc
                            setNodeOnFirstMessageOnly: true
                            transportApiVersion: V3
                          initialFetchTimeout: 0s
                          resourceApiVersion: V3
            

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: FILTER_CHAIN
    match:
      listener:
        filterChain:
          transportProtocol: tls
          destinationPort: 9080
    patch:
      operation: MERGE
      value:
        transport_socket:
          name: envoy.transport_sockets.tap
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.transport_sockets.tap.v3.Tap
            common_config:
              admin_config:
                config_id: test_config_id
              static_config:
                match_config:
                  any_match: true
                output_config:
                  sinks:
                  - file_per_tap:
                      path_prefix: /var/log/tap
                    #format: JSON_BODY_AS_BYTES             
            transport_socket:
                name: envoy.transport_sockets.tls
                typed_config:
                  '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
                  common_tls_context:
                    alpn_protocols:
                    - h2
                    - http/1.1
                    combined_validation_context:
                      default_validation_context:
                        match_subject_alt_names:
                        - prefix: spiffe://cluster.local/
                      validation_context_sds_secret_config:
                        name: ROOTCA
                        sds_config:
                          api_config_source:
                            api_type: GRPC
                            grpc_services:
                            - envoy_grpc:
                                cluster_name: sds-grpc
                            set_node_on_first_message_only: true
                            transport_api_version: V3
                          initial_fetch_timeout: 0s
                          resource_api_version: V3
                    tls_certificate_sds_secret_configs:
                    - name: default
                      sds_config:
                        api_config_source:
                          api_type: GRPC
                          grpc_services:
                          - envoy_grpc:
                              cluster_name: sds-grpc
                          set_node_on_first_message_only: true
                          transport_api_version: V3
                        initial_fetch_timeout: 0s
                        resource_api_version: V3
                    tls_params:
                      cipher_suites:
                      - ECDHE-ECDSA-AES256-GCM-SHA384
                      - ECDHE-RSA-AES256-GCM-SHA384
                      - ECDHE-ECDSA-AES128-GCM-SHA256
                      - ECDHE-RSA-AES128-GCM-SHA256
                      - AES256-GCM-SHA384
                      - AES128-GCM-SHA256
                      tls_minimum_protocol_version: TLSv1_2
                  require_client_certificate: true
            

apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-v1
  labels:
    app: productpage
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: productpage
      version: v1
  template:
    metadata:
      annotations:
        sidecar.istio.io/userVolumeMount: '[{"name":"log", "mountPath":"/var/log/tap"}]'
        sidecar.istio.io/userVolume: '[{"name": "log", "emptyDir":{}}]'
      labels:
        app: productpage
        version: v1
    spec:
      serviceAccountName: bookinfo-productpage
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v1:1.16.2
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        securityContext:
          runAsUser: 1000
      volumes:
      - name: tmp
        emptyDir: {}

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster-remove
spec:
  workloadSelector:
    labels:
      app: productpage
  configPatches:
  - applyTo: FILTER_CHAIN
    match:
      listener:
        filterChain:
          transportProtocol: raw_buffer
          destinationPort: 9080
    patch:
      operation: REMOVE

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster
  namespace: istio-system 
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: CLUSTER
    match:   
      cluster:
        name: outbound|9080||productpage.istio.svc.cluster.local
    patch:
      operation: REMOVE
  - applyTo: CLUSTER
    patch:
      operation: ADD     
      value:
          type: EDS
          circuitBreakers:
            thresholds:
            - maxConnections: 4294967295
              maxPendingRequests: 4294967295
              maxRequests: 4294967295
              maxRetries: 4294967295
              trackRemaining: true
          connectTimeout: 10s
          edsClusterConfig:
            edsConfig:
              ads: {}
              initialFetchTimeout: 0s
              resourceApiVersion: V3
            serviceName: outbound|9080||productpage.istio.svc.cluster.local
          filters:
          - name: istio.metadata_exchange
            typedConfig:
              '@type': type.googleapis.com/udpa.type.v1.TypedStruct
              typeUrl: type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange
              value:
                protocol: istio-peer-exchange
          metadata:
            filterMetadata:
              istio:
                default_original_port: 9080
                services:
                - host: productpage.istio.svc.cluster.local
                  name: productpage
                  namespace: istio
          name: outbound|9080||productpage.istio.svc.cluster.local
          transportSocketMatches:
          - match: {}
            name: tlsMode-upstream_proxy_protocol
            transportSocket:
              name: envoy.transport_sockets.upstream_proxy_protocol
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
                config: 
                  version: V2
                transport_socket:
                  name: envoy.transport_sockets.tls
                  typed_config:
                    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
                    common_tls_context:
                      combinedValidationContext:
                        defaultValidationContext:
                          matchSubjectAltNames:
                          - exact: spiffe://cluster.local/ns/istio/sa/bookinfo-productpage
                        validationContextSdsSecretConfig:
                          name: ROOTCA
                          sdsConfig:
                            apiConfigSource:
                              apiType: GRPC
                              grpcServices:
                              - envoyGrpc:
                                  clusterName: sds-grpc
                              setNodeOnFirstMessageOnly: true
                              transportApiVersion: V3
                            initialFetchTimeout: 0s
                            resourceApiVersion: V3
                      tlsCertificateSdsSecretConfigs:
                      - name: default
                        sdsConfig:
                          apiConfigSource:
                            apiType: GRPC
                            grpcServices:
                            - envoyGrpc:
                                clusterName: sds-grpc
                            setNodeOnFirstMessageOnly: true
                            transportApiVersion: V3
                          initialFetchTimeout: 0s
                          resourceApiVersion: V3
                    sni: outbound_.9080_._.productpage.istio.svc.cluster.local

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: cluster
  namespace: istio-system 
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: GATEWAY
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
              name: envoy.filters.network.http_connection_manager
              typedConfig:
                '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                route_config:
                  name: test
                  virtual_hosts:
                  - name: test
                    domains:
                    - "www.baidu.demo:32688"
                    routes:
                    - name: testroute
                      match: 
                        path: /
                      route:
                        cluster: static-cluster
  - applyTo: CLUSTER
    patch:
      operation: ADD
      value:
        name: static-cluster
        connect_timeout: 0.25s
        type: STATIC
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: static-cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: 36.152.44.95
                    port_value: 80