EnvoyFilterUsesRelativeOperation

Message NameEnvoyFilterUsesRelativeOperation
Message CodeIST0151
DescriptionThis EnvoyFilter does not have a priority and has a relative patch operation set which can cause the EnvoyFilter not to be applied. Using the INSERT_FIRST or ADD option or setting the priority may help in ensuring the EnvoyFilter is applied correctly.
LevelWarning

This message occurs when an EnvoyFilter does not have a priority and uses a relative patch operation (INVALID, MERGE, REMOVE, INSERT_BEFORE, INSERT_AFTER, REPLACE). Using a relative patch operation means that the operation depends on another filter being there when the current EnvoyFilter filter is evaluated. To ensure that the EnvoyFilters are applied in the order that the users want then a priority should be given or an non-relative operation (ADD or INSERT_FIRST) should be used.

An example

Consider an EnvoyFilter with the patch operation of INSERT_BEFORE:

  1. apiVersion: networking.istio.io/v1alpha3
  2. kind: EnvoyFilter
  3. metadata:
  4. name: test-relative
  5. namespace: bookinfo
  6. spec:
  7. workloadSelector:
  8. labels:
  9. app: reviews2
  10. configPatches:
  11. # The first patch adds the Lua filter to the listener/http connection manager
  12. - applyTo: HTTP_FILTER
  13. match:
  14. context: SIDECAR_INBOUND
  15. listener:
  16. portNumber: 8080
  17. filterChain:
  18. filter:
  19. name: "envoy.filters.network.http_connection_manager"
  20. subFilter:
  21. name: "envoy.filters.http.router"
  22. patch:
  23. operation: INSERT_BEFORE
  24. value: # Lua filter specification
  25. name: envoy.lua
  26. typed_config:
  27. "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
  28. inlineCode: |
  29. function envoy_on_request(request_handle)
  30. -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
  31. local headers, body = request_handle:httpCall(
  32. "lua_cluster",
  33. {
  34. [":method"] = "POST",
  35. [":path"] = "/acl",
  36. [":authority"] = "internal.org.net"
  37. },
  38. "authorize call",
  39. 5000)
  40. end

How to resolve

Because the relative operation of INSERT_BEFORE was used, changing it to absolute operation of INSERT_FIRST would resolve the issue:

  1. apiVersion: networking.istio.io/v1alpha3
  2. kind: EnvoyFilter
  3. metadata:
  4. name: test-relative
  5. namespace: bookinfo
  6. spec:
  7. workloadSelector:
  8. labels:
  9. app: reviews2
  10. configPatches:
  11. # The first patch adds the Lua filter to the listener/http connection manager
  12. - applyTo: HTTP_FILTER
  13. match:
  14. context: SIDECAR_INBOUND
  15. listener:
  16. portNumber: 8080
  17. filterChain:
  18. filter:
  19. name: "envoy.filters.network.http_connection_manager"
  20. subFilter:
  21. name: "envoy.filters.http.router"
  22. patch:
  23. operation: INSERT_BEFORE
  24. value: # Lua filter specification
  25. name: envoy.lua
  26. typed_config:
  27. "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
  28. inlineCode: |
  29. function envoy_on_request(request_handle)
  30. -- Make an HTTP call to an upstream host with the following headers, body, and timeout.
  31. local headers, body = request_handle:httpCall(
  32. "lua_cluster",
  33. {
  34. [":method"] = "POST",
  35. [":path"] = "/acl",
  36. [":authority"] = "internal.org.net"
  37. },
  38. "authorize call",
  39. 5000)
  40. end