概述

EnvoyFilter提供了定制化修改服務網格數據面配置的能力，通過EnvoyFilter可以實現修改某個數據面配置字段、添加或修改過濾器、監聽器、集群等配置，功能十分強大，所以在使用改功能時必須小心，確保對數據面配置有比較深入的理解；錯誤的配置可能影響網格數據面的穩定性。

對于任何數據面，允許存在多個EnvoyFilter匹配該數據面，位于根命名空間的EnvoyFilter優先級最高，其次是位于數據面所在的命名空間的EnvoyFilter。

注意
EnvoyFilter API和服務網格底層實現耦合較為緊密，在升級網格版本的時候需要關注已經定義的EnvoyFilter版本和新版本的網格是否存在兼容性問題
多個EnvoyFilter匹配同一個數據面時，生效的優先級為根命名空間下的EnvoyFilter優先級最高，其他的按照創建時間順序生效；如果EnvoyFilter之間存在沖突，結果是未定義的
需要配置EnvoyFilter匹配不同的工作負載時（比如網關和sidecar），可以考慮在根命名空間下定義，且不配置workloadselector

配置示例

配置示例一

在根命名空間下創建全局生效的EnvoyFilter，在sidecar outbound方向9307端口的tcp proxy插件之前插入mongo的代理配置；為所有數據面（網關和sidecar）的HttpConnectionManager插件配置HTTP空閑連接時間為30秒。

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: custom-protocol
  namespace: istio-system # as defined in meshConfig resource.
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_OUTBOUND # will match outbound listeners in all sidecars
      listener:
        portNumber: 9307
        filterChain:
          filter:
            name: "envoy.filters.network.tcp_proxy"
    patch:
      operation: INSERT_BEFORE
      value:
        # This is the full filter config including the name and typed_config section.
        name: "envoy.extensions.filters.network.mongo_proxy"
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy"
          ...
  - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
    match:
      # context omitted so that this applies to both sidecars and gateways
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        name: "envoy.filters.network.http_connection_manager"
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          common_http_protocol_options:
            idle_timeout: 30s

配置示例二

為bookinfo命名空間下匹配標簽app: reviews的工作負載下發自定義配置，在sidecar入站方向HttpConnectionManager中的最后一個Router插件之前插入lua插件，在收到請求后會執行lua代碼調用一個外部授權服務；這個外部授權服務通過一個外部域名標識，也通過配置下發到數據面

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: reviews-lua
  namespace: bookinfo
spec:
  workloadSelector:
    labels:
      app: reviews
  configPatches:
    # The first patch adds the lua filter to the listener/http connection manager
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 8080
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: INSERT_BEFORE
      value: # lua filter specification
       name: envoy.filters.http.lua
       typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
          defaultSourceCode:
            inlineString: |
              function envoy_on_request(request_handle)
                -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
                local headers, body = request_handle:httpCall(
                 "lua_cluster",
                 {
                  [":method"] = "POST",
                  [":path"] = "/acl",
                  [":authority"] = "internal.org.net"
                 },
                "authorize call",
                5000)
              end
  # The second patch adds the cluster that is referenced by the lua code
  # cds match is omitted as a new cluster is being added
  - applyTo: CLUSTER
    match:
      context: SIDECAR_OUTBOUND
    patch:
      operation: ADD
      value: # cluster specification
        name: "lua_cluster"
        type: STRICT_DNS
        connect_timeout: 0.5s
        lb_policy: ROUND_ROBIN
        load_assignment:
          cluster_name: lua_cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    protocol: TCP
                    address: "internal.org.net"
                    port_value: 8888

配置示例三

為根命名空間下匹配istio: ingressgateway標簽的網關下發自定義配置，當請求sni是app.example.com時給HttpConnectionManager配置HTTP空閑連接時間和XFF信任的跳數

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: hcm-tweaks
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
    match:
      context: GATEWAY
      listener:
        filterChain:
          sni: app.example.com
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          xff_num_trusted_hops: 5
          common_http_protocol_options:
            idle_timeout: 30s

配置說明

EnvoyFilter

EnvoyFilter.EnvoyConfigObjectPatch

EnvoyFilter.EnvoyConfigObjectMatch

Envoy過濾器匹配條件

EnvoyFilter.ProxyMatch

EnvoyFilter.ListenerMatch

EnvoyFilter.ListenerMatch.FilterChainMatch

存在多個filter chain的情況下可以用于匹配特定filter chain

EnvoyFilter.ListenerMatch.FilterMatch

EnvoyFilter.ListenerMatch.SubFilterMatch

EnvoyFilter.RouteConfigurationMatch

EnvoyFilter.RouteConfigurationMatch.VirtualHostMatch

EnvoyFilter.RouteConfigurationMatch.RouteMatch

EnvoyFilter.ClusterMatch