istio - 未使用简单的特使过滤器

Question

大家好，我是 Envoy 和 Istio 的新手。我正在尝试编写一个特使过滤器来重写/重定向 HTTP(s) 请求。下面是我的配置(是的，一个玩具示例)，它不工作。

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: lua-filter
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.router"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         "@type": "type.googleapis.com/envoy.config.filter.http.lua.v2.Lua"
         inlineCode: |
            function envoy_on_request(request_handle)
                request_handle:headers():add("authorization", "it works!")
            end
            function envoy_on_response(response_handle)
                  filter_name = "ENVOY"
                  response_handle:headers():add("my_Filter", filter_name)
            end

在部署应用程序(在 Cloudflare 后面的 443 端口监听 https)和 envoy 过滤器后，我执行 curl -v <my_app> .我没有看到添加的请求 header 或响应 header 。我也尝试添加 xff_num_trusted_hops: 2其他一些答案建议但无济于事。我做错了什么？

Answer 1

要将过滤器应用于单个 pod，您必须为您的应用添加 workloadSelector。

  workloadSelector:
    labels:
      xxx: xxx

例如，有一个 nginx 部署和具有适当 workloadSelector 的 envoy 过滤器。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx1
spec:
  selector:
    matchLabels:
      run: nginx1
  replicas: 1
  template:
    metadata:
      labels:
        run: nginx1
        app: frontend
    spec:
      containers:
      - name: nginx1
        image: nginx
        ports:
        - containerPort: 80


apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: lua-filter
  namespace: default
spec:
  workloadSelector:
    labels:
      run: nginx1
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.router"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         "@type": "type.googleapis.com/envoy.config.filter.http.lua.v2.Lua"
         inlineCode: |
            function envoy_on_request(request_handle)
                request_handle:headers():add("authorization", "it works!")
            end
            function envoy_on_response(response_handle)
                  filter_name = "ENVOY"
                  response_handle:headers():add("my_Filter", filter_name)
            end

---

将过滤器应用于所有通过您的 istio 入口网关的请求。

1.将更改上下文从 SIDECAR_INBOUND 更改为 GATEWAY。

2.设置一个workloadSelector。

  workloadSelector:
    labels:
      istio: ingressgateway

3.设置istio-system命名空间。

  namespace: istio-system

4.经过几次编辑后有你的例子。

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: lua-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.router"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         "@type": "type.googleapis.com/envoy.config.filter.http.lua.v2.Lua"
         inlineCode: |
            function envoy_on_request(request_handle)
                request_handle:headers():add("authorization", "it works!")
            end
            function envoy_on_response(response_handle)
                  filter_name = "ENVOY"
                  response_handle:headers():add("my_Filter", filter_name)
            end

5.我用curl查了一下

curl -s -I -X HEAD xx.xx.xx.xx/productpage

HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 5179
server: istio-envoy
date: Tue, 10 Nov 2020 08:28:30 GMT
x-envoy-upstream-service-time: 60
my_filter: ENVOY    <---

和

我在 istio ingress-gateway pod 中使用 config_dump 检查了它。

我在那里执行

kubectl exec -ti istio-ingressgateway-86f88b6f6-2tv64 -n istio-system -- /bin/bash

config_dump 的结果

curl 0:15000/config_dump | grep my_Filter
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  140k    0  140k    0     0   9.7M      0 --:--:-- --:--:-- --:--:--  9.7M
               "inline_code": "function envoy_on_request(request_handle)\n    request_handle:headers():add(\"authorization\", \"it works!\")\nend\nfunction envoy_on_response(response_handle)\n      filter_name = \"ENVOY\"\n      response_handle:headers():add(\"my_Filter\", filter_name)\nend\n"

---

其他资源:

• https://discuss.istio.io/t/adding-custom-response-headers-using-istios-1-6-0-envoy-lua-filter/7494/6
• https://istio.io/latest/docs/reference/config/networking/envoy-filter/