Questions tagged [envoyproxy]
Use this tag for questions about the Envoy xDS APIs or Envoy internals.
682
questions
0
votes
0
answers
12
views
How to access an external service from within Istio Service Mesh using an internal host name
I have an external IBM MQ application and I want to access it from within the mesh being able to apply network resilience features on top of it.
The way I thought to do it is:
-define a host for the ...
0
votes
0
answers
20
views
What Envoy metric should be used to measure server latency?
My server is a service deployed to service mesh implemented by Envoy and Istio sidecars. I only have access to Envoy metrics. The HTTP server receives requests from clients external to the mesh as in ...
0
votes
1
answer
37
views
Communicate with downstream envoy behind private network from Upstream Envoy
I just opened this issue on envoy but feel the stackOverflow community can add value.
See Diagram for better understanding:
Also See the link to wireguard achieving something similiar below:
Title: ...
1
vote
1
answer
58
views
How to deploy sidecarless envoy in Istio using eBPF?
I read this very interesting article that shows how to use sidecarless envoy:
https://events.istio.io/istiocon-2022/sessions/sidecarless-ebpf-envoy/
But it does not show any hands on as to how to ...
0
votes
0
answers
26
views
Poor performance of envoy vs when we test inside the container
We have the following envoy configuration:
admin:
access_log_path: /tmp/admin_access.log
address:
socket_address:
protocol: TCP
address: 0.0.0.0
port_value: 9901
...
0
votes
1
answer
29
views
How to understand envoy latency using `upstream_rq_time` metric?
I'm trying to understand how Envoy upstream_rq_time works. Essentially, I can see the following metrics in Grafana:
upstream_rq_time.p25
upstream_rq_time.p50
upstream_rq_time.p95
When querying any ...
0
votes
0
answers
44
views
Micro Services with API Gateway - Ocelot vs Envoy
I have a .NET core based micro service architecture and have several micro services. We chose ocelot as api gateway for routing, aggregation & security implementation. During our architectural ...
0
votes
0
answers
38
views
GCP Authentication Envoy Filter with Anthos Service Mesh
I am trying to get the GCP Auth Filter running.
According to Envoy's release notes, it should be available with 1.22.
I am using Anthos Service Mesh 1.14, which should be based to Envoy 1.22
Output is:...
0
votes
1
answer
12
views
Ambassador mapping not exposing chosen service
I'm having troubles with exposing node.js app via Ambassador mapping. I created a deployment and service, tested them from a dummy nginx pod using curl:
curl example-svc:9000/ping
And i get a correct ...
0
votes
0
answers
59
views
Envoy proxy returning 'no healthy upstream' and/or ERR_EMPTY_RESPONSE for ASP.NET application
I'm trying to setup an example ASP.NET project that uses envoy to route between the secure and non-secure versions of the app. The application works fine in Docker on both http and https, but when I ...
0
votes
0
answers
19
views
Set egress http header to SIDECAR_OUTBOUND from ingress SIDECAR_INBOUND/GATEWAY request by Envoy filter
Envoy filter support add/remove/merge, etc. operation for SIDECAR_INBOUND/SIDECAR_OUTBOUND or GATEWAY ingress/egress.
I have a requirement that need pass a specific business HTTP header through all ...
0
votes
1
answer
24
views
How to apply EnvoyFilter to Sidecar Inbound and Gateway?
I want to configure an EnvoyFilter to run only on Gateway and Sidecar-Inbound. Gateway and the Apps are in different namespaces.
If I specify the context as ANY, it will apply to Gateway, Sidecar-...
0
votes
1
answer
38
views
How can I set an envoy local rate limit, on all the paths starting with a given path?
How can I set an envoy local rate limit, on all the paths starting with a given path?
eg: I want to enforce the same rate limit on the URLs starting with : /swagger-ui/...
I've tried a couple of ...
0
votes
1
answer
39
views
Istio EnvoyFilter Lua HTTP Filter - How to get request URI from request_handle?
I know that 2 Lua functions are called in a filter when a call is made :
function envoy_on_request(request_handle)
end
function envoy_on_response(response_handle)
end
How can I retrieve the Request ...
0
votes
0
answers
16
views
how to use retries for local rate limiter envoy requests
I want to set up a retry policy for requests that have been restricted by the local rate limiter. The documentation states that you must add envoy-ratelimited to the retry_on field.
But somehow it ...
0
votes
0
answers
19
views
EnvoyFilter is not applied when rediness gate exists and health check failed in Istio
We have an EnvoyFilter for route http request to upstream application port as below:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: my-envoy-filter
spec:
...
0
votes
1
answer
29
views
Istio EnvoyFilter - Wasm - Classifying Metrics Based on Request or Response
I am trying to insert a custom dimension for an istio metric for URL path.
I am following the steps here -
https://istio.io/latest/docs/tasks/observability/metrics/classify-metrics/
Specifically, this ...
0
votes
1
answer
30
views
Istio Sidecar Connection Pooling?
I've been reading documentation up and down all day and I can't seem to get this to work.
I have an unruly application that opens a connection for every HTTP request. I would like to improve ...
0
votes
1
answer
18
views
Disable accesslog through EnvoyFilters CRD
The normal way is setting empty string through meshConfig.accessLogFile.
but i don't have the permission to update the global config.
So I try to disabled accesslog through EnvoyFilter CRD.
apiVersion:...
0
votes
0
answers
25
views
Protobuf 3 optional vs FieldMasks
Now that protocol buffers 3 has support for optional fields which lets you test whether the field was set or not, are FieldMasks still useful?
For instance, when implementing an Update method in gRPC ...
0
votes
1
answer
114
views
Istio Envoy Filter Lua - Updating Response Body get stuck
By following envoy filter to intercept upstream response I was able to create envoy filter and it's partially working as well. I can see my https request is being interpreted by the envoy filter and ...
0
votes
1
answer
36
views
Istio outbound https traffic troubleshooting
I have 2 AKS clusters, Cluster 1 and Cluster 2 both running Istio 1.14 minimal out-of-the-box (default configs).
Everything on Cluster 1 works as expected (after deploying Istio).
On Cluster 2, all ...
0
votes
0
answers
14
views
Envoy Jaeger HTTPS collector endpoint
I'm using Envoy as a proxy for Service Mesh with Consul Connect. I have configured envoy to send traces to an Jaeger collector(AWS ALB) in the Zipkin format. The configuration is the Zipkin one ...
0
votes
0
answers
19
views
How to install multiple istio control plane on same kubernetes cluster
We want to install multiple istio control plane on same kubernetes cluster.
We installed istio by like
istioctl install -f istioOperator.yaml
istioOperator.yaml is based on
istioctl profile dump ...
0
votes
0
answers
19
views
How to setup Istio Egress Rate Limiter for HTTPS Endpoint?
Asking for some examples on creating Istio Egress Rate Limit for external https endpoint, i.e. https://www.google.com/
1
vote
1
answer
45
views
Envoy parallel filter
Imagine that I have service A which provides the proper response for the requests and service B which wants to observe all the requests and do some time consuming tasks like logging all the requests, ...
0
votes
0
answers
48
views
mTLS between services running inside and outside a mesh using Istio's trust chain
I understand that I can configure Istio for its Citadel component to use a root x509 certificate + private key that I provide. Can I extend this system in a way that I also use the same root to issue ...
1
vote
1
answer
53
views
Envoy proxy is using too much memory
Envoy is using all the memory and the pods are getting evicted. Is there a way to set limit to how much memory envoy proxy can use in the envoy configuration file?
0
votes
1
answer
23
views
How to limit requests based on source IP on Istio
I am using istio version 1.12.
I tried to add limit configuration but it can't limit requests based on source IP.Does Istio support this?
I am using the official sample:
https://istio.io/v1.12/docs/...
1
vote
1
answer
98
views
Envoy Lua Local Script File
I am trying to implement lua script into an evnoy configuration file
What I want is to write my lua code within a local lua file and then scpecify my script file inside the envoy configuration file
...
0
votes
1
answer
99
views
Istio: DestinationRule for a legacy service outside the mesh
I have a k8s cluster with Istio deployed in the istio-system namespace, and sidecar injection enabled by default in another namespace called mesh-apps. I also have a second legacy namespace which ...
0
votes
1
answer
31
views
Access log entries are not logged in istio sidecar for ingress traffic
I have alb ingress which routes its traffic to istio-ingressgateway.
From there I have a gateway:
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: "X-gateway"
...
0
votes
0
answers
50
views
using backtrack regex in istio
We are migrating from ingress-nginx to istio. While migrating existing ingress definitions to istio VirtualServices, we came across nginx style rewriting and wanted to achieve the same in istio. When ...
0
votes
2
answers
54
views
Implement Envoy OAuth2 filter with disabled routes
I deployed an envoy as a side car to manage oauth2. Everything work fine for all the resources and the client is redirected to the OIDC in order to authenticate.
Here is a part of my conf (managed in ...
0
votes
1
answer
86
views
Istio "Error dispatching received data: http/1.1 protocol error: unsupported transfer encoding", when encoding is "gzip", "deflate" or "chunked"
Our microservice(in Kotlin, ktor) is served by Apache Tomcat, all works fine until it was deployed to a Kubernetes cluster with Istio and we came across the below scenario:
The below request fails ...
0
votes
1
answer
20
views
build a new proxyv2 image?
how do I build a new proxyv2 image as some of the envoy code modified? It seems that the official documentation does not have a particularly detailed introduction.
0
votes
0
answers
20
views
Envoy - failover to another control plane instance
In our setting, Envoy consumes dynamic configuration from the control plane via GRPC. The control plane discovery is configured as STRICT_DNS:
- name: cplane
connect_timeout: 5s
type: ...
0
votes
1
answer
80
views
How to enable log rotation in envoy file based logging?
I am using envoy as api gateway. For logging, I am using a file-based logging approach (schema - type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog).
The logs are accumulated in ...
2
votes
1
answer
48
views
How do I programmatically start an envoy sidecar proxy in consul connect?
I was following the following tutorial on consul learn (https://learn.hashicorp.com/tutorials/consul/service-mesh-with-envoy-proxy).
Everything makes sense to me up until the point where the envoy ...
0
votes
0
answers
118
views
x-envoy-upstream-service-time is more large than expected respond time
We are using seldon-core + ambassador 1.14.3 to build our services.
But recently we found that some respond time from ambassador is too long.
the upstream pod after ambassador just calc n + 1 and ...
1
vote
0
answers
23
views
Can I make Istio 1.4.10 local rate limit?
I'm working on istio 1.4.10, I need local rate limit replace nginx rate limit.
Istio 1.4.10 explain just grobal rate limit via redis.
but recent doc explain local rate limit with envoy.
So Can i make ...
0
votes
0
answers
151
views
Caused by: java.net. SocketException: Broken pipe (Write failed) Error occurs at Istio Envoy Proxy (EKS Envorinment)
Intermittent WriteException has occurred on traffic to AWS DocumentDB (mongodb) and is suffering.
When Istio Proxy is disabled, Error does not occurs.
But, SocketException errors occur intermittently ...
0
votes
0
answers
13
views
Listening to domain names instead of IP/Port
I have been playing around with Envoy recently and I'd like to migrate from Nginx to Envoy (I am still doubtful if comparing Envoy against Nginx is even right!). Envoy's configurations, unlike Nginx ...
0
votes
0
answers
23
views
In Envoy , how to perform zone aware routing only for request with specific header values?
click here for image
Goal is to allow cross zone routing for request with header header_value=1 and for header_value=2 , only to local cluster as shown in attached image.
How can i achieve this.?
1
vote
0
answers
97
views
SNI based routing in envoy
I am working on a use case to do SNI based routing in envoy without doing TLS termination
Scenario:
Customer makes a HTTPS request for domain name dd-server_name-zion-zorfy.com
I need to extract the ...
0
votes
0
answers
251
views
Envoy setup for grpc-web
I'm a bit confused as to how to set up Envoy with gRPC web.
According to the documentation, "we will use the Envoy proxy to forward the gRPC browser request to the backend server. You can see the ...
0
votes
1
answer
159
views
grpc client shows Unavailable errors during server scale up
I have two grpc services that communicate to each other using Istio service mesh and have envoy proxies for all the services.
We have an issue where during the scaling up of server pods due to high ...
0
votes
0
answers
53
views
Compared with Envoy and Apache APISIX, which one is more suitable for service mesh selection?
Want to select a service mesh, currently concerned about Envoy and Apache APISIX, Can any developer who has used both service grids help me to choose ?
0
votes
0
answers
46
views
Communicating Go Microservice with Java Spring Microservice
I'm looking to create a persistent datastore in Go as one of my microservices for user sessions. The user sessions are saved to Badger and a majority of my services are in Java Spring boot and our ...
0
votes
0
answers
165
views
how does Istio Envoy proxy use iptables in macOS?
As I know, macOS doesn't have iptables but has pf(packet filter) which is similar to iptables. But when I see istio-init container's log, I see istio envoy proxy is running command about initializing ...