kind: Deployment
metadata:
  name: external-forward-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: external-forward-proxy
  template:
    metadata:
      labels:
        app: external-forward-proxy
    spec:
      securityContext:
        runAsUser: 65534
        runAsGroup: 65534
        fsGroup: 65534
      containers:
      - name: external-forward-proxy
        image: envoyproxy/envoy:v1.21.0

↩️ 👥 ✔️ 🗳 ⏮️ ➡ 🔡 `/api/v1` 👆 📱, 🕸 💪 ☕ 🗄 🔗 `/api/v1/openapi.json`.

```mermaid
graph LR

browser("Browser")
proxy["Proxy on http://0.0.0.0:9999/api/v1/app"]
server["Server on http://127.0.0.1:8000/app"]

browser --> proxy
proxy --> server
```

!!! tip
    📢 `0.0.0.0` 🛎 ⚙️ ⛓ 👈 📋 👂 🔛 🌐 📢 💪 👈 🎰/💽.

🩺 🎚 🔜 💪 🗄 🔗 📣 👈 👉 🛠️ `server` 🔎 `/api/v1` (⛅ 🗳). 🖼:

这是因为应用使用了以 `/api/v1` 为路径前缀的代理，前端要从 `/api/v1/openapi.json`  中提取 OpenAPI 概图。

```mermaid
graph LR

browser("Browser")
proxy["Proxy on http://0.0.0.0:9999/api/v1/app"]
server["Server on http://127.0.0.1:8000/app"]

browser --> proxy
proxy --> server
```

!!! tip "提示"

    IP `0.0.0.0` 常用于指程序监听本机或服务器上的所有有效 IP。

API 文档还需要 OpenAPI 概图声明 API `server` 位于 `/api/v1`（使用代理时的 URL）。例如：

        service.istio.io/canonical-name: default-istio
        service.istio.io/canonical-revision: latest
        sidecar.istio.io/inject: "false"
    spec:
      containers:
      - args:
        - proxy
        - router
        - --domain
        - $(POD_NAMESPACE).svc.<no value>
        - --proxyLogLevel
        - <nil>
        - --proxyComponentLogLevel
        - <nil>
        - --log_output_level

        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{},"securityContext":{"runAsUser":1234,"runAsGroup":4321}}]}'
        sidecar.istio.io/interceptionMode: REDIRECT

        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","command":["envoy"],"args":["-c","my-config.yaml"],"resources":{}}]}'

        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{}}]}'

        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{},"securityContext":{"runAsUser":1234,"runAsGroup":4321}}]}'

      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      containers:
      - name: hello
        image: "fake.docker.io/google-samples/hello-go-gke:1.0"
      - name: istio-proxy
        image: auto
        securityContext:
          # iptables rules must honor this value, and must not use 1337
          runAsUser: 1234

        prometheus.io/scrape: "true"
        sidecar.istio.io/proxyImage: docker.io/istio/proxy2_debug:unittest
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
      creationTimestamp: null
      labels: