istio - 增加 Istio 中的 header 大小

Question

当用户有多个与之关联的角色时，授权持有者 token 将超过 istio 提供的最大 header 大小，从而阻止所有请求。

授权不记名 token 超过 35,000 个字符，大小为 34K。

如何增加 istio 提供的最大 header 大小？

Answer 1

据我所知，从 istio 1.5 开始你会使用 Control Headers and Routing

但是正如上面链接中提到的

The mixer policy is deprecated in Istio 1.5 and not recommended for production usage.

Consider using Envoy ext_authz filter, lua filter, or write a filter using the Envoy-wasm sandbox.

---

正如特使 documentation 中提到的，您可以使用 max_request_headers 来增加 header 大小。

max_request_headers_kb

The maximum request headers size for incoming connections. If unconfigured, the default max request headers allowed is 60 KiB. Requests that exceed this limit will receive a 431 response. The max configurable limit is 96 KiB, based on current implementation constraints.

---

如上所述，您可以使用 envoy filter来改变它。

EnvoyFilter provides a mechanism to customize the Envoy configuration generated by Istio Pilot. Use EnvoyFilter to modify values for certain fields, add specific filters, or even add entirely new listeners, clusters, etc. This feature must be used with care, as incorrect configurations could potentially destabilize the entire mesh. Unlike other Istio networking objects, EnvoyFilters are additively applied. Any number of EnvoyFilters can exist for a given workload in a specific namespace. The order of application of these EnvoyFilters is as follows: all EnvoyFilters in the config root namespace, followed by all matching EnvoyFilters in the workload’s namespace.

看一下 max_request_headers here 的示例.

您可以找到更多使用 Envoy 过滤器的示例 here和 here .