lua envoyFilter ignored in istio-sidecar

Question

I am trying to make an envoyFilter work in istio-sidecar.

It seems that :

Injection occurs. As my filter is present in my cluster's resources and istiod pushes to my sidecars whenever I update the filter. (And my pods and my filter are in the same namespace)
The label I use to selection is present on the pod.

But my script is totally ignored. Please, what did I missed ?

PS : I got the lua from envoy's ref :

piVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: authent-filter
  namespace: sma-app-integration
spec:
  workloadSelector:
    labels:
      com.effia.smartaccess/secured: enabled
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.router"
    patch:
      operation: INSERT_FIRST
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
              function envoy_on_request(request_handle)
                request_handle:respond({[":status"] = "100"},"nope")
              end

Edit : Well we couldn't make it work and switch to Nginx. A recent feature get the job done.

score 1 · Answer 1 · answered Feb 25 '21 at 18:25

I think that you should change contect to "context: GATEWAY" as this is for ingress traffic and has to be applied to all the gateways.

Then you can check that it exists by doing a config dump: kubectl exec $pod -n $namespace -c istio-proxy -- pilot-agent request GET config_dump > dump.json

And search for "authent-filter" to see if it's applied.

lua envoyFilter ignored in istio-sidecar

1 Answers1