CODEWITHSUNDEEP
kubernetesistio
Mageshwaran Kct
Mageshwaran Kct

Reputation: 21

control headers and routing depcrecated in istio 1.6

I need to route my traffic based on the headers using istio but this option is deprecated in istio1.6 version. Why control headers and routing is deprecated in istio?

Upvotes: 1

Views: 796

Answers (1)

Jakub
Jakub

Reputation: 8830

As mentioned in istio documentation

The mixer policy is deprecated in Istio 1.5 and not recommended for production usage.

Consider using Envoy ext_authz filter, lua filter, or write a filter using the Envoy-wasm sandbox.

Control headers and routing are not deprecated, it's just mixer which was used to do that. There are different ways to do that now, as mentioned above.

I'm not sure what exactly you want to do, but take a look at envoy filter and virtual service.

Envoy filter

There is envoy filter which add some custom headers to all the outbound responses

kind: EnvoyFilter
metadata:
  name: lua-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
            subFilter:
              name: "envoy.router"
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         "@type": "type.googleapis.com/envoy.config.filter.http.lua.v2.Lua"
         inlineCode: |
            function envoy_on_response(response_handle)
                response_handle:logInfo(" ========= XXXXX ========== ")
                response_handle:headers():add("X-User-Header", "worked")
            end

And tests from curl

$ curl -s -I -X HEAD x.x.x.x/
HTTP/1.1 200 OK
server: istio-envoy
date: Mon, 06 Jul 2020 08:35:37 GMT
content-type: text/html
content-length: 13
last-modified: Thu, 02 Jul 2020 12:11:16 GMT
etag: "5efdcee4-d"
accept-ranges: bytes
x-envoy-upstream-service-time: 2
x-user-header: worked

Few links worth to check about that:

Virtual Service

Another thing worth to check here would be virtual service, you can do header routing based on matches here.

Take a look at example from istio documentation

HttpMatchRequest specifies a set of criterion to be met in order for the rule to be applied to the HTTP request. For example, the following restricts the rule to match only requests where the URL path starts with /ratings/v2/ and the request contains a custom end-user header with value jason.

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings-route
spec:
  hosts:
  - ratings.prod.svc.cluster.local
  http:
  - match:
    - headers:
        end-user:
          exact: jason
      uri:
        prefix: "/ratings/v2/"
      ignoreUriCase: true
    route:
    - destination:
        host: ratings.prod.svc.cluster.local

Additionally there is my older example with header based routing in virtual service.

Let me know if you have any more questions.

Upvotes: 3

Related Questions