# Example Envoy bootstrap config showing how to use
# extract_only_without_validation with an RBAC policy that checks
# the verification status header before trusting JWT-derived headers.
#
# The RBAC policy only allows requests where:
#   1. The JWT claim 'role' equals 'admin', AND
#   2. The x-jwt-signature-verified header is NOT 'false'
# This prevents forged JWTs from satisfying the admin role check.
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        protocol: TCP
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: default
              domains:
              - "*"
              routes:
              - match:
                  prefix: "/admin"
                direct_response:
                  status: 200
                  body:
                    inline_string: "admin OK"
          http_filters:
          - name: envoy.filters.http.jwt_authn
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
              providers:
                example_provider:
                  issuer: https://example.com
                  claim_to_headers:
                  - header_name: x-jwt-claim-role
                    claim_name: role
                  # extract_only_without_validation does not verify signatures,
                  # but the JWKS must still parse and contain at least one valid
                  # public key. This dummy RSA key satisfies that requirement
                  # without being used to verify anything.
                  local_jwks:
                    inline_string: >-
                      {"keys": [
                        {"kty":"RSA",
                         "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86z
                              wu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc
                              5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8K
                              JZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh
                              6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKn
                              qDKgw",
                         "e":"AQAB",
                         "alg":"RS256",
                         "kid":"dummy"}]}
              rules:
              - match:
                  prefix: "/admin"
                requires:
                  extract_only_without_validation: {}
          - name: envoy.filters.http.rbac
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
              rules:
                action: ALLOW
                policies:
                  admin_verified_only:
                    permissions:
                    - any: true
                    principals:
                    - and_ids:
                        ids:
                        - header:
                            name: x-jwt-claim-role
                            string_match:
                              exact: admin
                        - not_id:
                            header:
                              name: x-jwt-signature-verified
                              string_match:
                                exact: "false"
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
