Istio/Envoy 邊緣代理 EnvoyFilter (1.9.0)

Question

我正在嘗試將一些Envoy 邊緣代理最佳實踐配置應用到我的 Istio 1.9.0 部署中，並且我正在努力獲得一個成功的 EnvoyFilter。 我申請后所有入口流量都返回 503。

使用istioctl我看到配置被應用並且代理狀態看起來很健康......有什么想法嗎？

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: connection-control
  namespace: istio-system
spec:
  configPatches:
  - applyTo: CLUSTER
    patch:
      operation: MERGE
      value:
        connect_timeout: 5s
        per_connection_buffer_limit_bytes: 32768 # 32 KiB
        http2_protocol_options:
          initial_stream_window_size: 65536 # 64 KiB
          initial_connection_window_size: 1048576 # 1 MiB
  - applyTo: NETWORK_FILTER
    match:      
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          common_http_protocol_options:
            idle_timeout: 3600s # 1 hour
            headers_with_underscores_action: REJECT_REQUEST
          http2_protocol_options:
            max_concurrent_streams: 100
            initial_stream_window_size: 65536 # 64 KiB
            initial_connection_window_size: 1048576 # 1 MiB
          stream_idle_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
          request_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests

注意：我已經搜索了網絡並嘗試了基本上所有可能的“工作”解決方案。 這個配置代表了我認為對 1.9.0 來說最“正確”的解決方案。 流量控制和連接緩沖區限制應該是微不足道的，所以我必須遺漏一些小東西。

提前感謝您的任何建議！

Answer 1

所以經過一些調整后，我終於部署了一個可以工作的 EnvoyFilter：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: edge-proxy-protocol
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      # context omitted so that this applies to both sidecars and gateways
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          common_http_protocol_options:
            idle_timeout: 3600s # 1 hour
          http2_protocol_options:
            max_concurrent_streams: 100
            initial_stream_window_size: 65536 # 64 KiB
            initial_connection_window_size: 1048576 # 1 MiB
          stream_idle_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
          request_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests

但是，我仍然看到我想保持打開狀態的連接有 30 秒的超時……結果是全局 LB 級別存在超時。 謎團已解開，EnvoyFilter 按設計工作。