EnvoyFilter describes Envoy proxy-specific filters that can be used to
customize the Envoy proxy configuration generated by Istio networking
subsystem (Pilot). This feature must be used with care, as incorrect
configurations could potentially destabilize the entire mesh.
NOTE 1: Since this is break glass configuration, there will not be any backward compatibility across different Istio releases. In other words, this configuration is subject to change based on internal implementation of Istio networking subsystem.
NOTE 2: When multiple EnvoyFilters are bound to the same workload, all filter configurations will be processed sequentially in order of creation time. The behavior is undefined if multiple EnvoyFilter configurations conflict with each other.
NOTE 3: For filters of
filterType: HTTP you must include a
listenerProtocol: HTTP or the filter have no effect.
The following example for Kubernetes enables Envoy’s Lua filter for all inbound HTTP calls arriving at service port 8080 of the reviews service pod with labels “app: reviews”.
apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: name: reviews-lua spec: workloadLabels: app: reviews filters: - listenerMatch: portNumber: 8080 listenerType: SIDECAR_INBOUND # will match with the inbound listener for reviews:8080 listenerProtocol: HTTP filterName: envoy.lua filterType: HTTP filterConfig: inlineCode: | ... lua code ...
Envoy filters to be added to a network or http filter chain.
Indicates the relative index in the filter chain where the filter should be inserted.
Index/position in the filter chain.
Insert before the named filter.
Insert after the named filter.
Select a listener to add the filter to based on the match conditions. All conditions specified in the ListenerMatch must be met for the filter to be applied to a listener.
HTTP or HTTPS (with termination) / HTTP2/gRPC
Any non-HTTP listener
Inbound listener in sidecar
Outbound listener in sidecar