How to insert an EnvoyFilter after another?

Networking
1

Hi,

I have applied a Lua EnvoyFilter using the examples on https://istio.io/latest/docs/reference/config/networking/envoy-filter/. Now, I want to apply another filter of the same kind but ensure it is always executed after the first one. The EnvoyFilter-Patch object has an operation field that accepts an INSERT_AFTER value. But I could not figure out how to specify an object this insert after operation refers to.

Let’s say I have two filters like this.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: check-header
spec: {...}

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: remove-header
spec: {...}

I want to ensure the Lua script in the remove-header filter is always executed after the check-header filter.

2

you can name the Lua filters differently and match on name
or use can use priority

3

By lua filter name, do you mean the name of the EnvoyFilter object, as in metadata.name, or the name in patch.value.name? I think the patch.value.name is a predefined value.

    patch:
      operation: INSERT_BEFORE
      value: # lua filter specification
       name: envoy.filters.http.lua # <-- can I change this to "my-lua-filter-1"?
       typed_config: {}

About the FilterMatch object, is it the one referred in this example?

  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager" # <-- should this be my lua filter name?
            subFilter:
              name: "envoy.filters.http.router" # <-- or this one?

Thanks

4

I mean in the patch., you can change the name. typed_config has the type_url with which envoy will figure out what type of filter it is

operation: INSERT_BEFORE
  value: # lua filter specification
   name: envoy.filters.http.lua # <-- can I change this to "my-lua-filter-1"?
   typed_config: {}
5

After I found this helpful trick, I finally figured out how to use the math object.

istioctl proxy-config listeners istio-ingressgateway-123 --port 8080 -o yaml

It allows me to inspect all the filters and their orders. Then it is straightforward to figure out what filter.name and subFilter.name to use.

Thanks.