{
    "configs": [
        {
            "@type": "type.googleapis.com/envoy.admin.v3.EcdsConfigDump",
            "ecds_filters": [
                {
                    "version_info": "2022-12-08T09:07:09Z/10",
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "default.httpbin-rate-limiting",
                        "typed_config": {

  export AUTH_HEADER
fi

SIDECAR="${SIDECAR:-envoy}"

# OS-neutral vars. These currently only work for linux.
ISTIO_ENVOY_VERSION="${ISTIO_ENVOY_VERSION:-${PROXY_REPO_SHA}}"
ISTIO_ENVOY_DEBUG_URL="${ISTIO_ENVOY_DEBUG_URL:-${ISTIO_ENVOY_BASE_URL}/envoy-debug-${ISTIO_ENVOY_VERSION}${ISTIO_ENVOY_ARCH_SUFFIX}.tar.gz}"

  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.
  # If "TPROXY", use iptables TPROXY to redirect to Envoy.

        {
            "versionInfo": "2022-12-08T09:07:09Z/10",
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "default.httpbin-rate-limiting",
                "typedConfig": {
                    "@type": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
                    "config": {
                        "name": "default.httpbin-rate-limiting",

        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
      proxy:
        proxyVersion: ^1\.19.*
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:

const (
	// Istiod is used to indicate Istiod ALWAYS fetches the JWKs server
	Istiod JwksFetchMode = iota

	// Hybrid is used to indicate Envoy fetches the JWKs server when there is a cluster entry,
	// otherwise fallback to Istiod
	Hybrid

	// Envoy is used to indicate Envoy ALWAYS fetches the JWKs server
	Envoy
)

// String converts JwksFetchMode to readable string.
func (mode JwksFetchMode) String() string {
	switch mode {

              ISTIO_META_WASM_PLUGIN_RESOURCE_VERSION: "1605"
          runtime: envoy.wasm.runtime.v8
  lastUpdated: "2022-12-08T11:03:53.361Z"
  versionInfo: 2022-12-08T09:07:09Z/10
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: default.display-metadata
    typedConfig:
      '@type': type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
      config:
        configuration:

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /exact
                - urlPath:
                    path:

// See https://www.envoyproxy.io/docs/envoy/latest/api-v3/admin/v3/config_dump.proto
const (
	bootstrap configTypeURL = "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump"
	listeners configTypeURL = "type.googleapis.com/envoy.admin.v3.ListenersConfigDump"
	endpoints configTypeURL = "type.googleapis.com/envoy.admin.v3.EndpointsConfigDump"
	clusters  configTypeURL = "type.googleapis.com/envoy.admin.v3.ClustersConfigDump"

    labels:
      istio: ingressgateway
  configPatches:
    # The Envoy config you want to modify
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE