Istio 过滤器在 EKS 集群上的 Istio 1.9 上被完全忽略

Question

我正在尝试通过 Envoy 过滤器设置一个简单的 HTTP 过滤器。我正在使用使用 Terraform 制作的全新 EKS 集群，并且 Istio 与 Helm 一起安装到其最新版本和默认值。

我正在尝试使用一个简单的 python 脚本来接收 http 请求并打印标题。

下面，我正在使用的资源..

python 脚本：

    from flask import Flask, redirect, url_for, request, Response
    import logging
    app = Flask(__name__)
    
    @app.route('/status', methods=['GET', 'POST'])
    def parse_request():
        data = request.data  # data is empty
        # need posted data here
        headers = request.headers
        print(headers)
        app.logger.info(headers)
        status_code = Response(status=200)
        return status_code
    
    if __name__ == '__main__':
        app.run(app.run(debug=True, port=5000, host='0.0.0.0'))

K8s 清单：

1. 部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: http
  labels:
    app: http
spec:
  replicas: 1
  selector:
    matchLabels:
      app: http
  template:
    metadata:
      labels:
        app: http
        run: http_pod
    spec:
      containers:
      - image: flask_http_test:latest
        imagePullPolicy: Always
        name: http
        ports:
        - containerPort: 5000
      restartPolicy: Always
      imagePullSecrets:
      - name: regcred

1. 网关和虚拟服务

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mygateway
  labels:
    app: http
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
--- 
kind: VirtualService
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: http-service-vs
  namespace: http
  labels:
    app: http
spec:
  hosts:
    - "*"   # host name of api
  gateways:
  - mygateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: http-service-svc  # k8s service name
        port:
            number: 5000     # pod port
EOF

1. 特使过滤器

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: http-service-svc-header-filter
  namespace: http
spec:
  workloadLabels:
    app: http-service-svc
    namespace: http
  filters:
  - listenerMatch:
      portNumber: 5000
      listenerType: SIDECAR_INBOUND 
      listenerProtocol: HTTP
    filterName: envoy.lua
    filterType: HTTP
    filterConfig:
      inlineCode: |
          function envoy_on_request(request_handle)
                request_handle:headers():add("newheader", "it works!")
            end

我可以通过 Istio Ingress Gateway 访问我的服务，但问题是过滤器完全被忽略了。我也尝试在 istio-system 命名空间中定义添加过滤器，没有工作负载选择器，但它仍然被忽略。

有人知道问题出在哪里吗？

Answer 1

问题是您正在应用 istio 1.9 不支持的旧 EnvoyFilter api 版本。

参考EnvoyFilter docs

这应该可行：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: http-service-svc-header-filter
  namespace: http
spec:
  workloadSelector:
    labels:
      app: http
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 5000
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: INSERT_BEFORE
      value: 
       name: envoy.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          inlineCode: |
            function envoy_on_request(request_handle)
              request_handle:headers():add("newheader", "it works!")
            end