How to make a lua envoy filter work on the istio cluster?

2
votes

I am trying to get a lua envoy filter to work with istio gateway, but I added to the cluster and it is working as if the filter does not exists.

I have configured my istio cluster on GKE using this guide https://istio.io/docs/setup/kubernetes/install/kubernetes/.

Have anyone had the same problem?

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: edge-lua-filter
spec:
  workloadLabels:
    app: httpbin-gateway
  filters:
  - listenerMatch:
      listenerType: GATEWAY
    filterName: envoy.lua
    filterType: HTTP
    filterConfig:
      inlineCode: |
        -- Called on the request path.
        function envoy_on_request(request_handle)
            request_handle:headers():add("foo", "bar")
        end
        -- Called on the response path.
        function envoy_on_response(response_handle)
            body_size = response_handle:body():length()
            response_handle:headers():add("response-body-size", tostring(body_size))
        end

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
  namespace: foo
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
  namespace: foo
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway
  http:
  - route:
    - destination:
        port:
          number: 8000
        host: httpbin.foo.svc.cluster.local
3
istioenvoyproxy
Did you cross check using 'kubectl get EnvoyFilter" command? – mjkool

3 Answers

4
votes

You're applying the filter to the GATEWAY. The "app" name for the ingress gateway is "istio-ingressgateway", not "httpbin-gateway"

You have 2 options:

  1. Change workloadLabels
  workloadLabels:
    app: istio-ingressgateway

or

  1. Remove workloadLabels. Istio will apply the change to the GATEWAY pod automatically
1
votes

I agree with larsitto that you have probably problem with workloadLabels - try to leave it empty or specify some label that you specify in your deployment>spec>template>labels[]

This code works for me for example:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: hello_world
spec:
  workloadLabels:
  filters:
  - listenerMatch:
      listenerType: SIDECAR_INBOUND
      listenerProtocol: HTTP
    filterName: envoy.lua
    filterType: HTTP
    filterConfig:
      inlineCode: |
        ...
0
votes

If you use filterType HTTP, you also need to define the listenerProtocol attribute with value HTTP.

See also :

https://istio.io/docs/reference/config/networking/v1alpha3/envoy-filter/ :

NOTE 3: For filters of filterType: HTTP you must include a listenerMatch section with a listenerProtocol: HTTP or the filter have no effect.