Mixer Client

Describes the configuration state for the Mixer client library that’s built into Envoy.

APIKey

APIKey defines the explicit configuration for generating therequest.api_key attribute from HTTP requests.

See API Keysfor a general overview of API keys as defined by OpenAPI.

FieldTypeDescriptionRequired
querystring (oneof)API Key is sent as a query parameter. query represents thequery string parameter name.For example, query=api_key should be used with thefollowing request:
  1. GET /something?api_key=abcdef12345
Yes
headerstring (oneof)API key is sent in a request header. header represents theheader name.For example, header=X-API-KEY should be used with thefollowing request:
  1. GET /something HTTP/1.1X-API-Key: abcdef12345
Yes
cookiestring (oneof)API key is sent in acookie,For example, cookie=X-API-KEY should be used for thefollowing request:
  1. GET /something HTTP/1.1Cookie: X-API-KEY=abcdef12345
Yes

AttributeMatch

Specifies a match clause to match Istio attributes

FieldTypeDescriptionRequired
clausemap<string, StringMatch>Map of attribute names to StringMatch type.Each map element specifies one condition to match.Example:clause:source.uid:exact: SOURCE_UIDrequest.http_method:exact: POSTNo

HTTPAPISpec

HTTPAPISpec defines the canonical configuration for generatingAPI-related attributes from HTTP requests based on the method anduri templated path matches. It is sufficient for defining the APIsurface of a service for the purposes of API attributegeneration. It is not intended to represent auth, quota,documentation, or other information commonly found in other APIspecifications, e.g. OpenAPI.

Existing standards that define operations (or methods) in terms ofHTTP methods and paths can be normalized to this format for use inIstio. For example, a simple petstore API described by OpenAPIv2herecan be represented with the following HTTPAPISpec.

  1. apiVersion: config.istio.io/v1alpha2
  2. kind: HTTPAPISpec
  3. metadata:
  4. name: petstore
  5. namespace: default
  6. spec:
  7. attributes:
  8. attributes:
  9. api.service:
  10. stringValue: petstore.swagger.io
  11. api.version:
  12. stringValue: 1.0.0
  13. patterns:
  14. - attributes:
  15. attributes:
  16. api.operation:
  17. stringValue: findPets
  18. httpMethod: GET
  19. uriTemplate: /api/pets
  20. - attributes:
  21. attributes:
  22. api.operation:
  23. stringValue: addPet
  24. httpMethod: POST
  25. uriTemplate: /api/pets
  26. - attributes:
  27. attributes:
  28. api.operation:
  29. stringValue: findPetById
  30. httpMethod: GET
  31. uriTemplate: /api/pets/{id}
  32. - attributes:
  33. attributes:
  34. api.operation:
  35. stringValue: deletePet
  36. httpMethod: DELETE
  37. uriTemplate: /api/pets/{id}
  38. apiKeys:
  39. - query: api-key
FieldTypeDescriptionRequired
attributesAttributesList of attributes that are generated when any of the HTTPpatterns match. This list typically includes the “api.service”and “api.version” attributes.No
patternsHTTPAPISpecPattern[]List of HTTP patterns to match.No
apiKeysAPIKey[]List of APIKey that describes how to extract an API-KEY from anHTTP request. The first API-Key match found in the list is used,i.e. ‘OR’ semantics.The following default policies are used to generate therequest.api_key attribute if no explicit APIKey is defined.
  1. query: key,query: api_key, and thenheader: x-api-key`
No

HTTPAPISpecBinding

HTTPAPISpecBinding defines the binding between HTTPAPISpecs and one or moreIstioService. For example, the following establishes a bindingbetween the HTTPAPISpec petstore and service foo in namespace bar.

  1. apiVersion: config.istio.io/v1alpha2
  2. kind: HTTPAPISpecBinding
  3. metadata:
  4. name: my-binding
  5. namespace: default
  6. spec:
  7. services:
  8. - name: foo
  9. namespace: bar
  10. apiSpecs:
  11. - name: petstore
  12. namespace: default
FieldTypeDescriptionRequired
servicesIstioService[]One or more services to map the listed HTTPAPISpec onto.Yes
apiSpecsHTTPAPISpecReference[]One or more HTTPAPISpec references that should be mapped tothe specified service(s). The aggregate collection of matchconditions defined in the HTTPAPISpecs should not overlap.Yes

HTTPAPISpecPattern

HTTPAPISpecPattern defines a single pattern to match againstincoming HTTP requests. The per-pattern list of attributes isgenerated if both the http_method and uri_template match. Inaddition, the top-level list of attributes in the HTTPAPISpec is alsogenerated.

  1. pattern:
  2. - attributes
  3. api.operation: doFooBar
  4. httpMethod: GET
  5. uriTemplate: /foo/bar
FieldTypeDescriptionRequired
attributesAttributesList of attributes that are generated if the HTTP request matchesthe specified http_method and uri_template. This typicallyincludes the “api.operation” attribute.No
httpMethodstringHTTP request method to match against as defined byrfc7231. Forexample: GET, HEAD, POST, PUT, DELETE.No
uriTemplatestring (oneof)URI template to match against as defined byrfc6570. For example, thefollowing are valid URI templates:
  1. /pets/pets/{id}/dictionary/{term:1}/{term}/search{?q,lang}
Yes
regexstring (oneof)EXPERIMENTAL:ecmascript style regex-based match as defined byEDCA-262. Forexample,
  1. "^/pets/(.?)?"
Yes

HTTPAPISpecReference

HTTPAPISpecReference defines a reference to an HTTPAPISpec. This istypically used for establishing bindings between an HTTPAPISpec and anIstioService. For example, the following defines anHTTPAPISpecReference for service foo in namespace bar.

  1. - name: foo
  2. namespace: bar
FieldTypeDescriptionRequired
namestringThe short name of the HTTPAPISpec. This is the resourcename defined by the metadata name field.Yes
namespacestringOptional namespace of the HTTPAPISpec. Defaults to the encompassingHTTPAPISpecBinding’s metadata namespace field.No

HttpClientConfig

Defines the client config for HTTP.

FieldTypeDescriptionRequired
transportTransportConfigThe transport config.No
serviceConfigsmap<string, ServiceConfig>Map of control configuration indexed by destination.service. Thisis used to support per-service configuration for cases where amixerclient serves multiple services.No
defaultDestinationServicestringDefault destination service name if none was specified in theclient request.No
mixerAttributesAttributesDefault attributes to send to Mixer in both Check andReport. This typically includes “destination.ip” and“destination.uid” attributes.No
forwardAttributesAttributesDefault attributes to forward to upstream. This typicallyincludes the “source.ip” and “source.uid” attributes.No
ignoreForwardedAttributesboolWhether or not to use attributes forwarded in the request headers tocreate the attribute bag to send to mixer. For intra-mesh traffic,this should be set to “false”. For ingress/egress gateways, thisshould be set to “true”.No

IstioService

IstioService identifies a service and optionally service version.The FQDN of the service is composed from the name, namespace, and implementation-specific domain suffix(e.g. on Kubernetes, “reviews” + “default” + “svc.cluster.local” -> “reviews.default.svc.cluster.local”).

FieldTypeDescriptionRequired
namestringThe short name of the service such as “foo”.No
namespacestringOptional namespace of the service. Defaults to value of metadata namespace field.No
domainstringDomain suffix used to construct the service FQDN in implementations that support such specification.No
servicestringThe service FQDN.No
labelsmap<string, string>Optional one or more labels that uniquely identify the service version.Note: When used for a VirtualService destination, labels MUST be empty.No

NetworkFailPolicy

Specifies the behavior when the client is unable to connect to Mixer.

FieldTypeDescriptionRequired
policyFailPolicySpecifies the behavior when the client is unable to connect to Mixer.No
maxRetryuint32Max retries on transport error.No
baseRetryWaitDurationBase time to wait between retries. Will be adjusted by exponentialbackoff and jitter.No
maxRetryWaitDurationMax time to wait between retries.No

NetworkFailPolicy.FailPolicy

Describes the policy.

NameDescription
FAIL_OPENIf network connection fails, request is allowed and delivered to theservice.
FAIL_CLOSEIf network connection fails, request is rejected.

Quota

Specifies a quota to use with quota name and amount.

FieldTypeDescriptionRequired
quotastringThe quota name to chargeNo
chargeint32The quota amount to chargeNo

QuotaRule

Specifies a rule with list of matches and list of quotas.If any clause matched, the list of quotas will be used.

FieldTypeDescriptionRequired
matchAttributeMatch[]If empty, match all request.If any of match is true, it is matched.No
quotasQuota[]The list of quotas to charge.No

QuotaSpec

Determines the quotas used for individual requests.

FieldTypeDescriptionRequired
rulesQuotaRule[]A list of Quota rules.No

QuotaSpecBinding

QuotaSpecBinding defines the binding between QuotaSpecs and one or moreIstioService.

FieldTypeDescriptionRequired
servicesIstioService[]One or more services to map the listed QuotaSpec onto.Yes
quotaSpecsQuotaSpecReference[]One or more QuotaSpec references that should be mapped tothe specified service(s). The aggregate collection of matchconditions defined in the QuotaSpecs should not overlap.Yes

QuotaSpecBinding.QuotaSpecReference

QuotaSpecReference uniquely identifies the QuotaSpec used in theBinding.

FieldTypeDescriptionRequired
namestringThe short name of the QuotaSpec. This is the resourcename defined by the metadata name field.Yes
namespacestringOptional namespace of the QuotaSpec. Defaults to the value of themetadata namespace field.No

ServiceConfig

Defines the per-service client configuration.

FieldTypeDescriptionRequired
disableCheckCallsboolIf true, do not call Mixer Check.No
disableReportCallsboolIf true, do not call Mixer Report.No
mixerAttributesAttributesSend these attributes to Mixer in both Check and Report. Thistypically includes the “destination.service” attribute.In case of a per-route override, per-route attributes take precedenceover the attributes supplied in the client configuration.No
httpApiSpecHTTPAPISpec[]HTTP API specifications to generate API attributes.No
quotaSpecQuotaSpec[]Quota specifications to generate quota requirements.No
networkFailPolicyNetworkFailPolicySpecifies the behavior when the client is unable to connect to Mixer.This is the service-level policy. It overrides[mesh-levelpolicy][istio.mixer.v1.config.client.TransportConfig.network_fail_policy].No
forwardAttributesAttributesDefault attributes to forward to upstream. This typicallyincludes the “source.ip” and “source.uid” attributes.In case of a per-route override, per-route attributes take precedenceover the attributes supplied in the client configuration.Forwarded attributes take precedence over the static Mixer attributes,except in cases where there is clear configuration to ignore forwardedattributes. Gateways, for instance, should never use forwarded attributes.The full order of application is as follows:1. static Mixer attributes from the filter config;2. static Mixer attributes from the route config;3. forwarded attributes from the source filter config (if any and not ignored);4. forwarded attributes from the source route config (if any and not ignored);5. derived attributes from the request metadata.No

StringMatch

Describes how to match a given string in HTTP headers. Match iscase-sensitive.

FieldTypeDescriptionRequired
exactstring (oneof)exact string matchYes
prefixstring (oneof)prefix-based matchYes
regexstring (oneof)ECMAscript style regex-based matchYes

TcpClientConfig

Defines the client config for TCP.

FieldTypeDescriptionRequired
transportTransportConfigThe transport config.No
mixerAttributesAttributesDefault attributes to send to Mixer in both Check andReport. This typically includes “destination.ip” and“destination.uid” attributes.No
disableCheckCallsboolIf set to true, disables Mixer check calls.No
disableReportCallsboolIf set to true, disables Mixer check calls.No
connectionQuotaSpecQuotaSpecQuota specifications to generate quota requirements.It applies on the new TCP connections.No
reportIntervalDurationSpecify report interval to send periodical reports for long TCPconnections. If not specified, the interval is 10 seconds. This intervalshould not be less than 1 second, otherwise it will be reset to 1 second.No

TransportConfig

Defines the transport config on how to call Mixer.

FieldTypeDescriptionRequired
disableCheckCacheboolThe flag to disable check cache.No
disableQuotaCacheboolThe flag to disable quota cache.No
disableReportBatchboolThe flag to disable report batch.No
networkFailPolicyNetworkFailPolicySpecifies the behavior when the client is unable to connect to Mixer.This is the mesh level policy. The default value for policy is FAIL_OPEN.No
statsUpdateIntervalDurationSpecify refresh interval to write Mixer client statistics to Envoy sharememory. If not specified, the interval is 10 seconds.No
checkClusterstringName of the cluster that will forward check calls to a pool of mixerservers. Defaults to “mixer_server”. By using different names forcheckCluster and reportCluster, it is possible to have one set ofMixer servers handle check calls, while another set of Mixer servershandle report calls.NOTE: Any value other than the default “mixer_server” will require theIstio Grafana dashboards to be reconfigured to use the new name.No
reportClusterstringName of the cluster that will forward report calls to a pool of mixerservers. Defaults to “mixer_server”. By using different names forcheckCluster and reportCluster, it is possible to have one set ofMixer servers handle check calls, while another set of Mixer servershandle report calls.NOTE: Any value other than the default “mixer_server” will require theIstio Grafana dashboards to be reconfigured to use the new name.No
attributesForMixerProxyAttributesDefault attributes to forward to Mixer upstream. This typicallyincludes the “source.ip” and “source.uid” attributes. Theseattributes are consumed by the proxy in front of mixer.No
reportBatchMaxEntriesuint32When disable_report_batch is false, this value specifies the maximum numberof requests that are batched in report. If left unspecified, the default valueof report_batch_max_entries == 0 will use the hardcoded defaults ofistio::mixerclient::ReportOptions.No
reportBatchMaxTimeDurationWhen disable_report_batch is false, this value specifies the maximum elapsedtime a batched report will be sent after a user request is processed. If leftunspecified, the default report_batch_max_time == 0 will use the hardcodeddefaults of istio::mixerclient::ReportOptions.No

istio.mixer.v1.Attributes

Attributes represents a set of typed name/value pairs. Many of Mixer’sAPI either consume and/or return attributes.

Istio uses attributes to control the runtime behavior of services running in the service mesh.Attributes are named and typed pieces of metadata describing ingress and egress traffic and theenvironment this traffic occurs in. An Istio attribute carries a specific pieceof information such as the error code of an API request, the latency of an API request, or theoriginal IP address of a TCP connection. For example:

  1. request.path: xyz/abc
  2. request.size: 234
  3. request.time: 12:34:56.789 04/17/2017
  4. source.ip: 192.168.0.1
  5. target.service: example

A given Istio deployment has a fixed vocabulary of attributes that it understands.The specific vocabulary is determined by the set of attribute producers being usedin the deployment. The primary attribute producer in Istio is Envoy, althoughspecialized Mixer adapters and services can also generate attributes.

The common baseline set of attributes available in most Istio deployments is definedhere.

Attributes are strongly typed. The supported attribute types are defined byValueType.Each type of value is encoded into one of the so-called transport types presentin this message.

Defines a map of attributes in uncompressed format.Following places may use this message:1) Configure Istio/Proxy with static per-proxy attributes, such as source.uid.2) Service IDL definition to extract api attributes for active requests.3) Forward attributes from client proxy to server proxy for HTTP requests.

FieldTypeDescriptionRequired
attributesmap<string, AttributeValue>A map of attribute name to its value.No