static_resources:
  listeners:
  - address:
      socket_address:
        address: 0.0.0.0
        port_value: 8000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: {prefix: "/path/with/bandwidth/share"}
                route: {cluster: service_protected_by_bandwidth_share}
                typed_per_filter_config:
                  envoy.filters.http.bandwidth_share:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.bandwidth_share.v3.BandwidthShare
                    request_limit:
                      bucket_id: foo
                      kbps:
                        default_value: 10000
                        runtime_key: bandwidth_share_limit_foo
                    fill_interval: 0.1s
                    tenant_name_selector:
                      on_no_match:
                        action:
                          name: use_client_certificate_name_as_tenant_name
                          typed_config:
                            "@type": type.googleapis.com/envoy.config.core.v3.SubstitutionFormatString
                            omit_empty_values: true
                            text_format_source:
                              inline_string: '%CEL(re.extract(connection.subject_peer_certificate, R"CN=([^,]*)", "\\1"))%'
                            formatters:
                            - name: envoy.formatter.cel
                              typed_config:
                                "@type": type.googleapis.com/envoy.extensions.formatter.cel.v3.Cel
              - match: {prefix: "/"}
                route: {cluster: web_service}
          http_filters:
          - name: envoy.filters.http.bandwidth_share
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.bandwidth_share.v3.BandwidthShare
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: service_protected_by_bandwidth_share
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: service1
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: web_service
                port_value: 9000
  - name: web_service
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: service1
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: web_service
                port_value: 9000
