Retrieve remote IP by using EnvoyFilter in istio 1.2

Networking
1

Hi, I need to retrieve remote IP in istio 1.2.

I found L7LB + EnvoyFilter seems a good solution and I succeeded to retrieve remote IP in istio 1.5.

The envoyFilter is like:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: xff-config-envoyfilter
  namespace: istio-system
spec:
  workloadSelector:
    label:
      app: istio-ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
        portNumber: 443
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          use_remote_address: true
          xff_num_trusted_hops: 2

ref: https://github.com/soichisumi-sandbox/gprc-with-istio-and-ingress

The solution works only in istio 1.3 or above, but due to the circumstances of our environment(istio 1.2 is already running), this solution cannot be used.

I’ve already tried the old notation using filterConfig and it didn’t work (probably because 1.2 doesn’t support merging Configs).

The example old envoyFilter is:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: xff-envoy-envoyfilter
  namespace: istio-system
spec:
  workloadSelector:
    label:
      app: istio-ingressgateway
  filters:
  - listenerMatch:
      listenerType: GATEWAY
      listenerProtocol: HTTP
    filterName: "envoy.http_connection_manager"
    filterType: NETWORK
    filterConfig:
      use_remote_address: false
      xff_num_trusted_hops: 2

How do I set it up to work with istio 1.2?

2

I resolved this problem by the other way. istio 1.2 seems not to configure http_connection_manager.
So I implemented lua script to get remote IP from xff header.

the script is:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: xff-envoyfilter
  namespace: istio-system
spec:
  filters:
  - listenerMatch:
      listenerType: GATEWAY 
    filterName: envoy.lua
    filterType: HTTP
    filterConfig:
      inlineCode: |
        NUM_TRUSTED_HOPS = 1

        function split(str, ts)
          if ts == nil then return {} end

          local t = {} ; 
          i=1
          for s in string.gmatch(str, "([^"..ts.."]+)") do
            t[i] = s
            i = i + 1
          end

          return t
        end

        function setRemoteIP(request_handle)
          local xff = request_handle:headers():get("X-Forwarded-For")
          local ips = split(string.gsub(xff, " ", ""), ",")
          local size = table.getn(ips)
          if size < 1 + NUM_TRUSTED_HOPS then
            return
          end
          request_handle:headers():replace("X-Custom-External-IP", ips[size - NUM_TRUSTED_HOPS])  -- offset trusted proxies
        end

        function envoy_on_request(request_handle)
          setRemoteIP(request_handle)
        end