apiVersion:networking.istio.io/v1alpha3 kind:EnvoyFilter metadata: name:custom-protocol namespace:istio-config# as defined in meshConfig resource. spec: configPatches: -applyTo:NETWORK_FILTER match: context:SIDECAR_OUTBOUND# will match outbound listeners in all sidecars listener: portNumber:9307 filterChain: filter: name:"envoy.filters.network.tcp_proxy" patch: operation:INSERT_BEFORE value: # This is the full filter config including the name and typed_config section. name:"envoy.extensions.filters.network.mongo_proxy" typed_config: "@type":"type.googleapis.com/envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy" ... -applyTo:NETWORK_FILTER# http connection manager is a filter in Envoy match: # context omitted so that this applies to both sidecars and gateways listener: filterChain: filter: name:"envoy.filters.network.http_connection_manager" patch: operation:MERGE value: name:"envoy.filters.network.http_connection_manager" typed_config: "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager" common_http_protocol_options: idle_timeout:30s
apiVersion:networking.istio.io/v1alpha3 kind:EnvoyFilter metadata: name:reviews-lua namespace:bookinfo spec: workloadSelector: labels: app:reviews configPatches: # The first patch adds the lua filter to the listener/http connection manager -applyTo:HTTP_FILTER match: context:SIDECAR_INBOUND listener: portNumber:8080 filterChain: filter: name:"envoy.filters.network.http_connection_manager" subFilter: name:"envoy.filters.http.router" patch: operation:INSERT_BEFORE value:# lua filter specification name:envoy.filters.http.lua typed_config: "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua" inlineCode:| function envoy_on_request(request_handle) -- Make an HTTP call to an upstream host with the following headers, body, and timeout. local headers, body = request_handle:httpCall( "lua_cluster", { [":method"] = "POST", [":path"] = "/acl", [":authority"] = "internal.org.net" }, "authorize call", 5000) end # The second patch adds the cluster that is referenced by the lua code # cds match is omitted as a new cluster is being added -applyTo:CLUSTER match: context:SIDECAR_OUTBOUND patch: operation:ADD value:# cluster specification name:"lua_cluster" type:STRICT_DNS connect_timeout:0.5s lb_policy:ROUND_ROBIN load_assignment: cluster_name:lua_cluster endpoints: -lb_endpoints: -endpoint: address: socket_address: protocol:TCP address:"internal.org.net" port_value:8888
apiVersion:networking.istio.io/v1alpha3 kind:EnvoyFilter metadata: name:wasm-example namespace:myns spec: configPatches: # The first patch defines a named Wasm extension and provides a URL to fetch Wasm binary from, # and the binary configuration. It should come before the next patch that applies it. # This resource is visible to all proxies in the namespace "myns". It is possible to provide # multiple definitions for the same name "my-wasm-extension" in multiple namespaces. We recommend that: # - if overriding is desired, then the root level definition can be overriden per namespace with REPLACE. # - if overriding is not desired, then the name should be qualified with the namespace "myns/my-wasm-extension", # to avoid accidental name collisions. -applyTo:EXTENSION_CONFIG patch: operation:ADD# REPLACE is also supported, and would override a cluster level resource with the same name. value: name:my-wasm-extension typed_config: "@type":type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm config: root_id:my-wasm-root-id vm_config: vm_id:my-wasm-vm-id runtime:envoy.wasm.runtime.v8 code: remote: http_uri: uri:http://my-wasm-binary-uri configuration: "@type":"type.googleapis.com/google.protobuf.StringValue" value:| {} # The second patch instructs to apply the above Wasm filter to the listener/http connection manager. -applyTo:HTTP_FILTER match: listener: filterChain: filter: name:envoy.filters.network.http_connection_manager subFilter: name:envoy.filters.http.router patch: operation:INSERT_BEFORE value: name:my-wasm-extension# This must match the name above config_discovery: config_source: ads: {} type_urls: ["type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm"]
apiVersion:networking.istio.io/v1alpha3 kind:EnvoyFilter metadata: name:wasm-service namespace:myns spec: configPatches: -applyTo:LISTENER_FILTER match: context:SIDECAR_INBOUND# will match outbound listeners in all sidecars listener: portNumber:15006 listenerFilter:"envoy.filters.listener.tls_inspector" patch: operation:INSERT_BEFORE value: # This is the full filter config including the name and typed_config section. name:"envoy.filters.listener.proxy_protocol" typed_config: "@type":"type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
apiVersion:networking.istio.io/v1alpha3 kind:EnvoyFilter metadata: name:header-envoy-filter namespace:test spec: configPatches: -applyTo:HTTP_FILTER match: context:SIDECAR_INBOUND listener: filterChain: filter: name:envoy.filters.network.http_connection_manager subFilter: name:envoy.filters.http.router patch: operation:INSERT_BEFORE value: name:envoy.filters.http.lua typed_config: '@type':type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua inlineCode:| function envoy_on_request(request_handle) local authority = request_handle:headers():get(":authority") local version_header = request_handle:headers():get("project-version") if authority == "testaaa.com" then if version_header == nil then request_handle:headers():add("project-version", "master") end elseif authority == 'testbbb.com' then if version_header == nil then request_handle:headers():add("project-version", "master") end end end workloadSelector: labels: app:orange
EnvoyFilter
EnvoyFilter 提供了一种机制，可以定制由 Istio Pilot 生成的 Envoy 配置。
微信
