Istio ingress gateway json transcoding

JacobSMoller · July 31, 2020, 11:57am

I have successfully managed to get a json transcoding filter running in my cluster on one of my services.

I am not quite pleased with this solutuion however, because it requires me to route http traffic through my cluster instead of only routing grpc traffic.

Has anyone succeeded in appyling the json transcoding filter to the ingress gateway, so that http traffic stops at the edge of and is handled as all services behind the ingress gateway?/Is it even possible to use the envoy filter in this way.

JacobSMoller · August 5, 2020, 10:15am

Managed to get this working by using Kustomize to add a volume and volumeMount to the generated deployment for istio-ingressgateway. If it has any interest to anyone let me know, and i’ll provide some more detailed info

caiolopes · September 30, 2020, 3:09am

@JacobSMoller I am very interested in how you managed to do it! Can you please share more details and most important part of the configuration yaml? Thanks!

JacobSMoller · November 30, 2020, 5:40am

Hi @caiolopes, did you manage something. Sorry, got signed out of istio discuss, so haven’t been getting notifications.

Will put some more info in here when I get to the office in 2 hours or so.

JacobSMoller · November 30, 2020, 9:19am

Okay. So to make the json transcoding work without having to route HTTP traffic and do json transcoding in each service. What I did was.

Generate manifest using istioctl and istio operator with desired configuration.
Use kustomize to add volumemount and volume to the ingressgateway deployment(See:
https://github.com/e-conomic/vml-istio/blob/1fa92d643241cca0c7ca9991987adfe66faed848/istio-install/descriptor-volume.yaml,
https://github.com/e-conomic/vml-istio/blob/1fa92d643241cca0c7ca9991987adfe66faed848/istio-install/descriptor-mount.yaml and https://github.com/e-conomic/vml-istio/blob/1fa92d643241cca0c7ca9991987adfe66faed848/istio-install/kustomization.yaml)
The acutal descriptor is generated in our proto repository and applied as a configmap(https://github.com/e-conomic/vml-istio/blob/1fa92d643241cca0c7ca9991987adfe66faed848/manifests/istio-descriptor.yaml)
-And then applying a json transcoder filter that refers to the available services in the descriptor. (https://github.com/e-conomic/vml-istio/blob/1fa92d643241cca0c7ca9991987adfe66faed848/manifests/istio-json-transcode.yaml)

If also using ext_authz and rate limit envoy filters make sure to subfilter the json transcoder to be before those filters to ensure that the requests are transcoded before hitting the services implementing auth and rate limit endpoints.