Can't get EnvoyFilter to work


#1

Hi team,

I have the pod and service definition as follows:

---

kind: Pod
apiVersion: v1
metadata:
  name: stable-http-echo-app
  labels:
    app: stable
spec:
  containers:
    - name: http-echo-app
      image: hashicorp/http-echo
      ports:
      - containerPort: 5678
      args:
        - "-text=stable"

---

kind: Service
apiVersion: v1
metadata:
  name: stable-echo-service
spec:
  selector:
    app: stable
  ports:
    - port: 5678
      targetPort: 5678

This service is working fine as expected.

I wanted to make use of EnvoyFilter to make an another HTTP Call to service inside cluster to check for authentication status. Before making call to this auth service, I want to get cookie from this service and pass as an header to auth service.

As I am first time user, I just started with printing some basic info and adding response headers with EnvoyFilter, however, I coundn’t make it working. Below is my envoy filter spec:

--- 
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata: 
  name: stable-lua
spec: 
  filters: 
    - 
      filterConfig: 
        inlineCode: |
            function envoy_on_request(request_handle)
              local cookie = request_handle:headers():get("Cookie")
              request_handle:logInfo("reading cookies from headers")
              request_handle:logInfo(cookie)
            end
            function envoy_on_response(response_handle)
              response_handle:headers():add("x-this","works")
            end
      filterName: envoy.lua
      filterType: HTTP
      listenerMatch: 
        portNumber: 5678
        listenerType: ANY
  workloadLabels: 
    app: stable

The problem is I do not see any errors or logs in istio-proxy. So, I am little concern whether my envoyfilter is getting detected or not.

I do see the following warning Ignoring filter envoy.lua. Cannot insert HTTP filter in network filter chain in istio-pilot.

Can anyone suggest what am I be doing wrong.


#2

Ok, Here I am answering my own question for anyone facing similar problem

I was able to figure out the problem for this. The problem is that we will have to explicity add name to ports. if I set name to http explicitly, filter gets applied to the listener.

Similar issue that helped debugging and solving: https://github.com/istio/istio/issues/9716