Unable to use lua EnvoyFilter in istio

1

I’m trying to make EnvoyFilters work in samples/httpbin. For test purposes I’m trying to set lua filter add header to the request and response.

Here’s my configuration “envoy_filter.yaml”:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: httpbin-lua
  namespace: default
spec:
  workloadSelector:
    labels:
      app: httpbin
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          portNumber: 8000
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: MERGE
        value:
          name: envoy.lua
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
            inlineCode: |
              function envoy_on_request(request_handle)
                request_handle:headers():add("X-Foo", "bar")
              end
              function envoy_on_response(response_handle)
                body_size = response_handle:body():length()
                response_handle:headers():add("X-Response-Body-Size", tostring(body_size))
              end

istio version:

client version: 1.12.5
control plane version: 1.12.5
data plane version: 1.12.5 (10 proxies)

First, I ran httpbin:

$ kubectl apply -f samples/httpbin/httpbin.yaml
serviceaccount/httpbin unchanged
service/httpbin unchanged
deployment.apps/httpbin unchanged

Then I applied envoy_filter:

$ kubectl apply -f samples/httpbin/envoy_filter.yaml 
envoyfilter.networking.istio.io/httpbin-lua unchanged

And I used samples/sleep:

$ kubectl apply -f samples/sleep/sleep.yaml
$ export SLEEP_POD=$(kubectl get pods -l app=sleep -o 'jsonpath={.items[0].metadata.name}')
$ kubectl exec "$SLEEP_POD" -c sleep -- curl -isS http://httpbin:8000/headers

But in the end, I got the following results:

HTTP/1.1 200 OK
server: envoy
date: Sat, 06 May 2023 11:30:32 GMT
content-type: application/json
content-length: 526
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2

{
  "headers": {
    "Accept": "*/*", 
    "Host": "httpbin:8000", 
    "User-Agent": "curl/8.0.1-DEV", 
    "X-B3-Parentspanid": "543b430f504ae68a", 
    "X-B3-Sampled": "1", 
    "X-B3-Spanid": "e3b22fab06133bf6", 
    "X-B3-Traceid": "eb0456793d44966e543b430f504ae68a", 
    "X-Envoy-Attempt-Count": "1", 
    "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/httpbin;Hash=b4b6a461b0cbaad9fa4c033730a967741db8a532909f2fc64029b329b327bce1;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/sleep"
  }
}

In envoy_filter, I wrote the logic to add header, but the final result did not meet expectations.
Please help me, I would be very grateful.