Questions tagged [envoyproxy]
Use this tag for questions about the Envoy xDS APIs or Envoy internals.
841
questions
1
vote
0
answers
18
views
Using Apache Ranger as an external authorizer with Istio mesh
Iam new to Apache Ranger as well as Istio mesh. I have been trying to understand how to integrate Apache Ranger with Istio mesh as an external authorizer. As far as I have seen in the documentation ...
0
votes
0
answers
8
views
Zone Aware Routing in Envoy Proxy
I am confused in using Zone Aware Routing in Envoy Proxy. Envoy's documentation is quite confusing and I can't imagine what a configuration file to perform Zone Aware Routing would look like. Who can ...
0
votes
0
answers
15
views
Envoy Ratelimit - Applying global ratelimit filter on certain routes only
I am looking for a way to apply global ratelimit filter for certain routes only. Below is an example of what I trying to achieve.
For a host like "gateway.abc.com"
for prefixes say /catalog, ...
0
votes
0
answers
18
views
Istio Envoy Proxy breaks Thrift Service - Hive Metastore
I am trying to run the thrift server (Hive metastore aka HMS) behind the istio Envoy proxy. The HMS works well when I run the service in a namespace with istio-injection disabled. But when i try the ...
0
votes
0
answers
23
views
Envoy,gRPC Issue Could not load server reflection. Details: 14 UNAVAILABLE: upstream connect error or disconnect/reset before headers
I'm new to envoy. I'm trying to proxy 2 gRPC microservice request using envoy.
Service1 by accessing 8080 port and
Service2 in 8083 port and then When we try to connected through Envoy API gateway by ...
0
votes
0
answers
37
views
Envoy proxy memory usage spikes on service deployments
Using envoy as a proxy for our services. The envoy proxy is running inside a Kubernetes pod along with a service which acts as its control plane. All our services also run in Kubernetes and this envoy ...
0
votes
0
answers
53
views
Envoy proxy + Keycloak + JWT
There is a keycloak: http://IP:8080/
There's an envoy with a working config that redirects all requests to Keycloak:
admin:
access_log_path: /dev/null
address:
socket_address:
address: 0....
0
votes
1
answer
87
views
Enable TLS for my upstream gRPC cluster in Envoy
I have a web-grpc frontend application that communicates with my gRPC backend. As browsers do not "speak" gRPC, I need an envoy proxy to transform http requests to actual grpc and back. ...
0
votes
0
answers
13
views
envoyproxy listener filter for ssh traffic
Is there any filters available for listeners in envoy proxy to send the traffic to a seperate cluster,
I have similar config for haproxy
# 5353482d322e30 is the binary representation of the string '...
0
votes
0
answers
47
views
upstream connect error or disconnect/reset before headers in envoy proxy
I am trying to deploy an envoy proxy in a cloud run service which will act as an authentication gateway and do the token exchange with identity provider. Once it successfully authenticated it will ...
0
votes
1
answer
53
views
Error creating envoy OAuth2 filter using Docker
I have created the following following envoy configuration which will act as a authentication filter and communicate with CIDP and get the access token. Once successfully authenticated the redirection ...
0
votes
0
answers
24
views
How to create a grpc-over-rest proxy
Envoy's tutorial for creating a REST wrapper over a gRPC service starts with a google.api.http qualifier in the rpc definition like below, and generates the REST wrapper from that.
rpc SayHello(...
0
votes
0
answers
25
views
envoy external process sample with dot net grpc service
static_resources:
listeners:
address:
socket_address:
address: 0.0.0.0
port_value: 10000
filter_chains:
filters:
name: envoy.filters.network.http_connection_manager
typed_config:
"@type": ...
0
votes
0
answers
5
views
envoyproxy validate "Auth-Sub-Identities"?
We are exploring between nginx with js and envoy proxy, checking if there is instruction for envoy proxy to parse Auth-Sub-Identities in the headers and validate if the matching string is found ?
0
votes
2
answers
93
views
Envoy + grpc: Request header field x-user-agent is not allowed by Access-Control-Allow-Headers in preflight response
I have this issue:
Access to XMLHttpRequest at 'https://example.org:8443/main.MyService/Ping' from origin 'https://example.org' has been blocked by CORS policy: Request header field x-user-agent is ...
0
votes
0
answers
24
views
Run envoy proxy server without docker?
I would like to run the envoy proxy server without the docker.
Is there any way we can run the envoy proxy server using envoy binaries?
0
votes
0
answers
12
views
Envoy proxy hangs client connection?
I’m looking for ideas on debugging an issue we’re seeing in production. Sorry for the length of this post, but I want to include all the details that might help.
We are using Envoy v1.25.5 as an ...
0
votes
0
answers
37
views
Bundle envoy proxy with executable and ship it to end user machine
I am creating a C++ gRPC server and clients will be gRPC-web based.
As per the documentation this setup will require Envoy Proxy in between to convert HTTP 1.1 requests to HTTP2 and send it to gRPC ...
0
votes
0
answers
38
views
Health checks failed with these codes: [502] on AWS ALB when using Strapi enable AWS App Mesh on ECS
Summary
I have a Strapi app running on AWS ECS with AWS App Mesh Envoy. The App Mesh is configured using AWS Cloud Map. Initially, when I added the Envoy proxy container to the task definition using ...
0
votes
0
answers
21
views
Does http2MaxRequests in istio DestinationRules per-pod or per-service?
The definition is below(https://istio.io/latest/docs/reference/config/networking/destination-rule/), I wonder if the limit is per-pod or per-service?
Maximum number of active requests to a destination....
0
votes
0
answers
6
views
dynamically set maximum number of requests in envoy rate limit service
We use Envoy rate limit service to limit the number of requests hitting our service.
Deployment is similar to this:
apiVersion: apps/v1
kind: Deployment
metadata:
name: envoy-rate-limiter
spec:
...
0
votes
1
answer
63
views
Can HTTP/2 CONNECT be used as a reverse tunnel?
Is it possible to use HTTP/2 CONNECT or HTTP/3 QUIC CONNECT connection as a reverse tunnel such that the server end can multiplex HTTP requests back down the tunnel to the connection initiator?
This ...
0
votes
0
answers
13
views
envoy proxy validation context match OID (x509)?
Team : similar to this below information, is there a way to check "OID" X509 number ?
https://www.envoyproxy.io/docs/envoy/latest/start/quick-start/securing#use-mutual-tls-mtls-to-enforce-...
0
votes
0
answers
23
views
Pod not talking to itself
I was trying to learn more about envoy configurations and I found something that I keep wondering why it works that way but I can not find a answer. I was using this Example which can be found in the ...
0
votes
0
answers
46
views
Sidecar proxy in nomad/consul cluster doesn't work
Envoy sidecar proxy and terminating gateway deployed within my nomad tasks doesn't work.
[2023-10-03 13:32:50.415][1][info][admin] [source/server/admin/admin.cc:66] admin address: 127.0.0.2:19001
[...
0
votes
0
answers
27
views
sslVerifyClientStatus=optional equivalent in envoy-proxy?
Just like in nginx, we can implement by using this below example :
ssl_client_certificate /etc/nginx/root-ca/acme-ca-bundle.pem;
ssl_verify_client optional;
location / {
...
0
votes
0
answers
43
views
Istio Envoyproxy downstream_local_disconnect
I am using Istio 1.15.x. I've enabled access logging.
At the Istio-Ingresstatway, I see this in response:
ResponseCode="0" ResponseCodeDetails="downstream_local_disconnect"
The ...
0
votes
0
answers
44
views
how to setup envoy for react to call spring boot server using grpc on ec2 instance
This is the github repo: https://github.com/gwengusc/react-springboot-grpc-example
Every thing works fine when I use restful api for react to call spring boot both local and ec2.
However, I want to ...
0
votes
0
answers
55
views
Istio 1.15 how to local rate limit by IP address
I am looking to local rate limit via istio 1.15 by ip address. Per some other examples I've found it seems I should be able to set
key: remote_address
however this config is nowhere in the example in ...
0
votes
1
answer
155
views
How to send http request to a server on host inside wasm plugin of envoy?
Inside my wasm filter, I tried to use proxy-wasm-cpp-sdk to send a http request to a server on host machine. My C++ wasm code is:
auto r = httpCall(remote_addr,
{{":method&...
0
votes
1
answer
353
views
How to change log level of envoy proxy with environment variable
How can I change the default log level of the envoy proxy from info to something else ( like debug ) with an Environment variable? I know there is an --log-level option when running envoy, but I don't ...
0
votes
0
answers
22
views
Tracing Envoy's Global Rate Limit Service
I'm trying to get Envoy's global rate limiting filter filter to participate in end to end tracing using Open Telemetry.
I have configured the filter to use Lyft's reference rate limit service and that ...
1
vote
0
answers
26
views
Envoy client side authetication with certificate only - no key
I am looking to configure envoy to do downstream client authentication. Basically what cloudflare did here on nginx, I need to do that in envoy. The question is since the pem has certificate only and ...
0
votes
0
answers
34
views
Istio local rate limit network filter stops working after some time
I have a simple 'go' server listening for HTTPs traffic on port 8443 running in a container (inside a K8s cluster). I have an istio ingress gateway running at the edge of the K8s cluster (listening on ...
0
votes
1
answer
102
views
EnvoyFilter disable Distributed Tracing not working
I have the following set-up and use-case:
Openshift Version 4.12
Openshift ServiceMesh Version 2.4.1
Istio Version 1.16.5
Envoy Proxy Version 1.24.8
We noticed that during outbound requests (when a ...
0
votes
1
answer
55
views
Envoy TCP traffic shifting only for new connections
As per envoy official doc, TCP traffic shifting is possible with the weighted cluster. I have a case where TCP traffic shifting is needed from clusters A to B only for the new TCP connections. I have ...
0
votes
0
answers
96
views
Why do we need to initiate Tracing in Envoy as it has had x-request-id
I just read the doc of Envoy about Tracing but I'm confused by how it works.
The doc says:
How to initiate a trace
The HTTP connection manager that handles the request must have the tracing object ...
0
votes
0
answers
61
views
How can I prepend and append to a request body with envoy proxy lua bodyChunks?
I am using envoy.filters.http.lua and I would like to modify the request's body so that I can both prepend and append to the existing body. The simplest approach using body() is easy enough to ...
5
votes
1
answer
139
views
Why explicit protocol setting cause traffic routing error?
I write a virtual service to test header based routing
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: http-app
namespace: default
spec:
hosts:
- http-app....
1
vote
0
answers
49
views
In proxy-wasm-rust-sdk, how can I use plugin configuration in httpContext
My plugin configuration is quite large, and I don't want to clone the plugin configuration every time When I create an httpContext. Can I use Rc::clone() inside Wasm? (Is it may cause memory leak? Im ...
0
votes
0
answers
226
views
How to make Envoy Forward Proxy Example Configuration Work
I am attempting to setup envoy as a forward proxy. I am using the configuration file posted here: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/...
0
votes
0
answers
16
views
Put all the services behind the root path on Envoy Proxy
I have a series of gRPC services that I would like to put behind Envoy.
However I do not want to put there behind any prefix as it is usual showed in many how-to. I would like to have them all behind ...
-3
votes
1
answer
129
views
Can envoy route based on ip range?
I want envoy to dns lookup hostname and route request based on resolved ip range. For example, a hostname x.internal.com resolves to 10.0.0.1, which is internal because it's in range 10.0.0.0 – 10.255....
0
votes
0
answers
412
views
How to enable tcp_keepalive for upstream connections in envoy proxy
I am using setup where client -> envoy_proxy -> server.
My config.yaml for envoy proxy has following settings:
clusters:
- name: cluster1"
connect_timeout: 300s
...
0
votes
0
answers
98
views
How to log request and reponse body when using Kubernetes Istio
I'd like to log request and response json bodies for my kubernetes microservice. I use Istio service mesh. I know that Istio doesn't implement logging, but as far as I know I could use WASM and Envoy ...
0
votes
0
answers
31
views
Envoy proxy: I have a requirement to fetch the HTTP headers and send them in JSON format to 3rd party API
I have a requirement to fetch the HTTP headers and send them in JSON format to 3rd party API.
The problem is each HTTP stream has different set of headers which are not fixed.
I understand JSON means ...
1
vote
0
answers
146
views
Istio\Envoy: how to turn off headers normalization
Istio perform some normalization on duplicate HTTP headers: https://istio.io/latest/docs/reference/config/security/normalization/#2-duplicate-headers
Istio will merge duplicate headers to a single ...
0
votes
0
answers
52
views
envoy getting killed by cgroup due to outofmemory
Recently we have been observing OOM on envoy and envoy gets restarted.
Envoy version: 1.25.8
This is the configuration being used at envoyLB side:
` - name: testlb
address:
socket_address:
...
0
votes
0
answers
162
views
Istio: Envoy filter to remove server header
I would like to remove the server header being returned in the HTTP response when hitting the Health Check port 15021 for istio. Here is a example response:
< HTTP/1.1 404 Not Found
< date: Tue, ...
0
votes
0
answers
44
views
INVALID_ARGUMENT error while configuring envoy proxy
I am trying to set up an envoy proxy in my ECS service. I see the below logs in the task.
Unable to parse JSON as proto (INVALID_ARGUMENT: invalid JSON in envoy.config.bootstrap.v3.Bootstrap @
...