apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: dikastes
  namespace: istio-system
spec:
  hosts:
  - dikastes.calico.cluster.local
  ports:
  - name: grpc
    protocol: grpc
    number: 1
  resolution: STATIC
  location: MESH_EXTERNAL
  endpoints:
  - address: unix:///var/run/dikastes/dikastes.sock
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: dikastes-mtls
  namespace: istio-system
spec:
  host: dikastes.calico.cluster.local
  trafficPolicy:
    tls:
      mode: DISABLE
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ext-authz
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.tcp_proxy
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.ext_authz
        config:
          stat_prefix: "dikastes"
          grpc_service:
            envoy_grpc:
              cluster_name: "outbound|1||dikastes.calico.cluster.local"
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.http_connection_manager
            subFilter:
              name: envoy.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.ext_authz
        config:
          grpc_service:
            envoy_grpc:
              cluster_name: "outbound|1||dikastes.calico.cluster.local"
