Envoy, an open-source edge and service proxy, plays an integral role in modern service meshes such as Istio. One of its powerful features is the ability to manipulate HTTP headers dynamically using `EnvoyFilter`. However, sometimes users encounter situations where adding headers with `EnvoyFilter` does not work as expected. This article delves into the possible reasons for these issues and provides technical insights on resolving them.

Understanding EnvoyFilters

`EnvoyFilter` is a custom resource in Istio that allows users to apply modifications to the Envoy configuration. It can be incredibly versatile, giving users the flexibility to:

• Add, modify, or remove HTTP headers.
• Route traffic through specific clusters.
• Apply Lua scripts for additional logic.

The `EnvoyFilter` resource interacts directly with the Envoy proxy's configuration and can be used to manipulate requests and responses.

Common Reasons for Header Manipulation Failures

Incorrect Configuration Path

The ability to add headers using `EnvoyFilter` depends heavily on specifying the correct configuration path. Incorrect paths often lead to filter misfires. `EnvoyFilter` changes are applied at various configuration stages, such as `HTTP_CONNECTION_MANAGER`. Users must ensure that the correct `match` path is specified when they intend to add headers.

Incorrect Filter and Insert Position

Filters in Envoy are inserted in a specific sequence, and an improperly ordered filter chain may lead to unexpected results. If header additions depend on other preceding filters, these dependencies must be accounted for in the `filterChains`.

Context Application

The context where the `EnvoyFilter` is applied significantly influences its behavior. Users can specify the context as `SIDECAR_INBOUND`, `SIDECAR_OUTBOUND`, or `GATEWAY`. Selecting the wrong context inadvertently will cause the filter amendment to be ignored.

Overly Restrictive Matching Criteria

While targeting specific virtual services or routes is possible, utilizing overly strict matching criteria can inadvertently cause `EnvoyFilter` not to match any traffic. A balance has to be struck between specificity and generality in matching conditions.

Headers Already Present or Set by Envoy Rules

Envoy itself may establish boundaries on what can be modified, especially for security-sensitive headers (e.g., `Host`, `Content-Length`). If Envoy rules disallow modifications to headers or if headers exist and are immutable, the attempts to add them might fail.

Diagnosis and Troubleshooting

Diagnosis of why an `EnvoyFilter` does not work as expected involves:

• Logs and Debugging: Elevating log levels and examining `istio-proxy` logs can highlight issues with filter order or path mismatches.
• Configuration Verification: Reviewing the Istio and Envoy configurations for potential conflicts or misconfigurations.
• Envoy Admin Interface: Accessing the Envoy admin to inspect live configurations (`envoy/config_dump`) to ensure that the `EnvoyFilter` changes are reflected as expected.

Example Case Study

• applyTo: NETWORK_FILTER
  • name: envoy.filters.http.lua