Envoy Proxy
Environment variables to override default values:
| Key | Default | Type | Description |
|---|---|---|---|
| COMPONENTLOGLEVEL | grpc:debug,config:debug | str | Envoy’s component specific log level info |
| FYDE_PROXY_HOST | proxy-client | str | Orchestrator’s hostname / DNS record |
| FYDE_PROXY_PORT | 50051 | str | Orchestrator’s service port |
| LOGLEVEL | info | str | Envoy’s global log level info |
Proxy Orchestrator
The following override mechanisms will be processed in order, the last override representing the final value:
- Default value
- Configuration pushed from CloudGen Access Enterprise Console
- overrides.json file on the CWD of the service process
- Docker provisioned secret (/run/secrets/<key>)
- AWS SSM (all keys prefixed with the value from the ‘prefix’ key; disable check with env variable DISABLE_AWS_SSM=1 )
- AWS SecretsManager (all keys prefixed with the value from the ‘prefix’ key; disable check with env variable DISABLE_AWS_SEC_MANAGER=1 )
- Environment variable, prefixed with FYDE_ and all caps
- Command-line arguments in long-form notation like ‘--example’, all keys underscores converted to dashes.
| Key | Default | Type | Description |
|---|---|---|---|
| authz_pubkey | None | str | Authorizer EC Public Key (Used to verify authorization JWTs) |
| authz_timeout | 30 | int | CloudGen Access authorization call timeout (seconds) |
| enable_ipv6 | False | bool | Enable ipv6 usage for DNS in envoy |
| enrollment_token | None | str | Enrollment token provided by CloudGen Access Enterprise Console |
| envoy_listener_ip | ‘0.0.0.0’ | str | Envoy Proxy listener IP |
| envoy_listener_port | 8000 | int | Envoy Proxy listener port |
| envoy_prometheus | True | bool | Prometheus metrics for Envoy Proxy status |
| envoy_prometheus_ip | ‘0.0.0.0’ | str | Prometheus metrics for Envoy Proxy listener IP |
| envoy_prometheus_port | 9000 | int | Prometheus metrics for Envoy Proxy listener port |
| grpc_insecure | True | bool | gRPC insecure mode for the CloudGen Access Proxy Orchestrator |
| grpc_listener | ’[::]:50051’ | str | gRPC listener for the CloudGen Access Proxy Orchestrator |
| http_proxy | None | str | Use HTTP proxy. Example: “http://proxy.host:1234/” or “socks5://10.0.0.1:5555” |
| https_proxy | None | str | Use HTTPS proxy. Example: “https://proxy.host:1234/” or “socks5://10.0.0.1:5555” |
| prefix | fyde_ | str | Define the prefix used for keys stored in AWS SSM and AWS SecretsManager |
| proxy_prometheus | True | bool | Prometheus metrics for CloudGen Access Proxy Orchestrator status |
| proxy_prometheus_ip | ‘0.0.0.0’ | str | Prometheus metrics for CloudGen Access Proxy Orchestrator listener IP |
| proxy_prometheus_port | 9010 | int | Prometheus metrics for CloudGen Access Proxy Orchestrator listener port |
| redis_ssl | False | bool | Enable SSL support for Redis connections |
| redis_sentinel_ssl | False | bool | Enable SSL support for Redis Sentinel connections |
| redis_ssl_cert_reqs | ‘none’ | str | SSL Certificate verification options. one of ‘none’, ‘optional’, ‘required’. More info here |
| redis_ssl_key | None | str | Redis/Sentinel SSL client authentication private key This can be a path to a file holding the key or the content of it inlined in the variable |
| redis_ssl_cert | None | str | Redis/Sentinel SSL client authentication certificate This can be a path to a file holding the cert or the content of it inlined in the variable |
| redis_ssl_ca_certs | None | str | Redis/Sentinel SSL CA trusted anchors This can be a path to a file holding the certs or the content of it inlined in the variable |
| redis_auth | None | str | Redis auth key |
| redis_db | 0 | int | Redis database |
| redis_host | None | str | Used for HA mode only. Leave empty in CloudGen Access Proxy single mode. |
| redis_port | 6379 | int | Redis port |
| redis_timeout | 1.0 | float | Redis socket_timeout in seconds |
| redis_sentinel_hosts | None | str | Redis Sentinel comma-separated list of host:port pairs |
| redis_sentinel_service_name | None | str | Redis Sentinel service (cluster) name |
| redis_sentinel_wait_for_primary | 30 | int | Redis Sentinel time in seconds to wait for primary |