EnvoyFilterUsesRelativeOperationWithProxyVersion

消息名称EnvoyFilterUsesRelativeOperationWithProxyVersion
消息代码IST0155
描述This EnvoyFilter does not have a priority and has a relative patch operation (NSTERT_BEFORE/AFTER, REPLACE, MERGE, DELETE) and proxyVersion set which can cause the EnvoyFilter not to be applied during an upgrade. Using the INSERT_FIRST or ADD option or setting the priority may help in ensuring the EnvoyFilter is applied correctly.
等级Warning

当 EnvoyFilter 没有设置优先级并没有使用相关补丁操作（INSERT_BEFORE/AFTER、REPLACE、MERGE、DELETE）和 proxyVersion 时会出现此消息，这可能会导致 EnvoyFilter 升级期间没有被应用。使用 INSERT_FIRST 或 ADD 选项或设置优先级可能有助于确保 EnvoyFilter 被正确应用。关注 proxyVersion 的原因是，在升级后，proxyVersion 可能会发生变化，升级后它的使用顺序可能不同于升级前的顺序。

示例

考虑一个 EnvoyFilter 的补丁操作 REPLACE，并使用 proxyVersion：

  1. apiVersion: networking.istio.io/v1alpha3
  2. kind: EnvoyFilter
  3. metadata:
  4.   name: test-replace-3
  5.   namespace: bookinfo
  6. spec:
  7.   workloadSelector:
  8.     labels:
  9.       app: reviews4
  10.   configPatches:
  11.     # The first patch adds the Lua filter to the listener/http connection manager
  12.   - applyTo: HTTP_FILTER
  13.     match:
  14.       context: SIDECAR_OUTBOUND
  15.       proxy:
  16.         proxyVersion: '^1\.11.*'
  17.       listener:
  18.         portNumber: 8080
  19.         filterChain:
  20.           filter:
  21.             name: "envoy.filters.network.http_connection_manager"
  22.             subFilter:
  23.               name: "envoy.filters.http.router"
  24.     patch:
  25.       operation: REPLACE
  26.       value: # Lua filter specification
  27.        name: envoy.lua
  28.        typed_config:
  29.           "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
  30.           inlineCode: |
  31.             function envoy_on_request(request_handle)
  32.               -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
  33.               local headers, body = request_handle:httpCall(
  34.                "lua_cluster",
  35.                {
  36.                 [":method"] = "POST",
  37.                 [":path"] = "/acl",
  38.                 [":authority"] = "internal.org.net"
  39.                },
  40.               "authorize call",
  41.               1000)
  42.             end
  44. apiVersion: networking.istio.io/v1alpha3
  45. kind: EnvoyFilter
  46. metadata:
  47.   name: test-replace-4
  48.   namespace: bookinfo
  49. spec:
  50.   workloadSelector:
  51.     labels:
  52.       app: reviews4
  53.   configPatches:
  54.   - applyTo: HTTP_FILTER
  55.     match:
  56.       context: SIDECAR_OUTBOUND
  57.     patch:
  58.       operation: REPLACE
  59.       value: #Lua filter specification
  60.        name: envoy.lua
  61.        typed_config:
  62.           "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
  63.           inlineCode: |
  64.             function envoy_on_request(request_handle)
  65.               -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
  66.               local headers, body = request_handle:httpCall(
  67.                "lua_cluster",
  68.                {
  69.                 [":method"] = "POST",
  70.                 [":path"] = "/acl",
  71.                 [":authority"] = "internal.org.net"
  72.                },
  73.               "authorize call",
  74.               5000)
  75.             end

如何解决

因为 REPLACE 的相关操作是与 proxyVersion 一起使用，所以添加 priority 可以解决这个问题：

  1. apiVersion: networking.istio.io/v1alpha3
  2. kind: EnvoyFilter
  3. metadata:
  4.   name: test-replace-3
  5.   namespace: bookinfo
  6. spec:
  7.   workloadSelector:
  8.     labels:
  9.       app: reviews4
  10.   priority: 10
  11.   configPatches:
  12.     # The first patch adds the Lua filter to the listener/http connection manager
  13.   - applyTo: HTTP_FILTER
  14.     match:
  15.       context: SIDECAR_OUTBOUND
  16.       proxy:
  17.         proxyVersion: '^1\.11.*'
  18.       listener:
  19.         portNumber: 8080
  20.         filterChain:
  21.           filter:
  22.             name: "envoy.filters.network.http_connection_manager"
  23.             subFilter:
  24.               name: "envoy.filters.http.router"
  25.     patch:
  26.       operation: REPLACE
  27.       value: # Lua filter specification
  28.        name: envoy.lua
  29.        typed_config:
  30.           "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
  31.           inlineCode: |
  32.             function envoy_on_request(request_handle)
  33.               -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
  34.               local headers, body = request_handle:httpCall(
  35.                "lua_cluster",
  36.                {
  37.                 [":method"] = "POST",
  38.                 [":path"] = "/acl",
  39.                 [":authority"] = "internal.org.net"
  40.                },
  41.               "authorize call",
  42.               1000)
  43.             end
  45. apiVersion: networking.istio.io/v1alpha3
  46. kind: EnvoyFilter
  47. metadata:
  48.   name: test-replace-4
  49.   namespace: bookinfo
  50. spec:
  51.   workloadSelector:
  52.     labels:
  53.       app: reviews4
  54.   priority: 20
  55.   configPatches:
  56.   - applyTo: HTTP_FILTER
  57.     match:
  58.       context: SIDECAR_OUTBOUND
  59.     patch:
  60.       operation: REPLACE
  61.       value: #Lua filter specification
  62.        name: envoy.lua
  63.        typed_config:
  64.           "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
  65.           inlineCode: |
  66.             function envoy_on_request(request_handle)
  67.               -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
  68.               local headers, body = request_handle:httpCall(
  69.                "lua_cluster",
  70.                {
  71.                 [":method"] = "POST",
  72.                 [":path"] = "/acl",
  73.                 [":authority"] = "internal.org.net"
  74.                },
  75.               "authorize call",
  76.               5000)
  77.             end