We are trying to add headers to our request, that lands on a service in our kubernetes cluster. Let’s call this django-app. We have successfully enabled routing to two services in our cluster, and we have added authentication policy to verify the jwt from headers using public key jwks. In our next step, we want headers to be add to request after the jwt authentication is done, these headers would have value from the decoded jwt like user_id and jti. However we tried using the EnvoyFilter crd as follows:
– apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: add-header
spec:
workloadSelector:
labels:
app: django-app # Match the pod labels, not the service
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_INBOUND
listener:
filterChain:
filter:
name: --“envoy.filters.network.http_connection_manager”
subFilter:
name: “envoy.filters.http.router”
patch:
operation: INSERT_BEFORE
value:
name: --envoy.filters.http.lua
typed_config:
“@type”: “–type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua”
inlineCode: |
function envoy_on_request(request_handle)
request_handle:headers():add(“new-header”, “new-header-value”)
end
But we can see in logs:
warning envoy config external/envoy/source/common/config/grpc_subscription_impl.cc:128 gRPC config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) virtualInbound: Unable to unpack as envoy.extensions.filters.http.lua.v3.Lua: type_url: “type.googleapis.com/envoy.config.filter.http.lua.v2.Lua”
WARNING external/com_google_protobuf/src/google/protobuf/text_format.cc:2157] Can’t print proto content: proto type type.googleapis.com/envoy.config.filter.http.lua.v2.Lua not found
Can someone help here, also did anyone go through the same issue:
istio version 1.18.2