{{- if .Values.deployKF.gateway.enableProxyProtocol }}
################
## This EnvoyFilter enables the PROXY protocol on the main ingress gateway.
## This is sometimes used by some external proxies (like AWS NLB) to provide information about the original request.
## https://istio.io/v1.18/docs/ops/configuration/traffic-management/network-topologies/#proxy-protocol
################
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: deploykf-istio-gateway--enable-proxy-protocol
  labels:
    helm.sh/chart: {{ include "deploykf-istio-gateway.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-istio-gateway.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
spec:
  workloadSelector:
    labels:
      {{- toYaml .Values.deployKF.gateway.selectorLabels | nindent 6 }}
  configPatches:
    - applyTo: LISTENER_FILTER
      match:
        context: GATEWAY
      patch:
        operation: INSERT_FIRST
        value:
          name: envoy.filters.listener.proxy_protocol
          typed_config:
            ## https://www.envoyproxy.io/docs/envoy/v1.23.1/api-v3/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto.html?highlight=proxyprotocol#extensions-filters-listener-proxy-protocol-v3-proxyprotocol
            "@type": type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
{{- end }}