kubernetes - 使用 EnvoyFilter 添加 header 不起作用

Question

我正在测试 istio 1.10.3 以使用 minikube 添加 header ，但我无法这样做。

Istio 安装在 istio-system 命名空间中。部署部署的 namespace 标有 istio-injection=enabled。

在 config_dump 中，只有当上下文设置为 ANY 时，我才能看到 LUA 代码。当我将其设置为 SIDECAR_OUTBOUND 时，代码未列出:

"name": "envoy.lua",
"typed_config": {
"@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
"inline_code": "function envoy_on_request(request_handle)\n  request_handle:headers():add(\"request-body-size\", request_handle:body():length())\nend\n\nfunction envoy_on_response(response_handle)\n  response_handle:headers():add(\"response-body-size\", response_handle:body():length())\nend\n"
}

有人可以给我一些提示吗？

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: headers-envoy-filter
  namespace: nginx-echo-headers
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
         inline_code: |
           function envoy_on_request(request_handle)
             request_handle:headers():add("request-body-size", request_handle:body():length())
           end

           function envoy_on_response(response_handle)
             response_handle:headers():add("response-body-size", response_handle:body():length())
           end
  workloadSelector:
    labels:
      app: nginx-echo-headers
      version: v1

下面是我的部署和 Istio 配置:

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-echo-headers-v1
  namespace: nginx-echo-headers
  labels:
    version: v1
spec:
  selector:
    matchLabels:
      app: nginx-echo-headers
      version: v1
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx-echo-headers
        version: v1
    spec:
      containers:
      - name: nginx-echo-headers
        image: brndnmtthws/nginx-echo-headers:latest
        ports:
          - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-echo-headers-svc
  namespace: nginx-echo-headers
  labels:
    version: v1
    service: nginx-echo-headers-svc
spec:
  type: ClusterIP
  ports:
  - name: http
    port: 80
    targetPort: 8080
  selector:
    app: nginx-echo-headers
    version: v1
---
# ISTIO GATEWAY
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-echo-headers-gateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "api.decchi.com.ar"

# ISTIO VIRTUAL SERVICE
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-echo-headers-virtual-service
  namespace: nginx-echo-headers
spec:
  hosts:
  - 'api.decchi.com.ar'
  gateways:
  - istio-system/nginx-echo-headers-gateway
  http:
  - route:
      - destination:
          # k8s service name
          host: nginx-echo-headers-svc
          port:
            # Services port
            number: 80
          # workload selector
          subset: v1

## ISTIO DESTINATION RULE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx-echo-headers-dest
  namespace: nginx-echo-headers
spec:
  host: nginx-echo-headers-svc
  subsets:
    - name: "v1"
      labels:
        app: nginx-echo-headers
        version: v1

只有当我在 GATEWAY 中配置上下文时它才有效。 envoyFilter 在 istio-system 命名空间中运行，workloadSelector 配置如下:

workloadSelector:
    labels:
      istio: ingressgateway

但我的想法是在SIDECAR_OUTBOUND中配置。

Answer 1

it is only working when I configure the context in GATEWAY, the envoyFilter is running in the istio-system namespace

没错!您应该在配置根命名空间 istio-system 中应用您的 EnvoyFilter - 在您的情况下。

最重要的是，在匹配您的configPatches 时，只需省略context 字段，这样它就适用于sidecars 和gateways。您可以在this Istio Doc中查看使用示例.