<p>I am trying to set TCP idleTimeout via an Envoy Filter, so that outbound connections external domain <code>some.app.com</code> will be terminated if they are idle for 5s:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: listener-timeout-tcp
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          sni: some.app.com
          filter:
            name: envoy.filters.network.tcp_proxy
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.tcp_proxy
        typed_config:
          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
          idle_timeout: 5s
</code></pre>
<p>However, when I try to apply this filter I get the following error:</p>
<pre><code>Error from server: error when creating &quot;filter.yaml&quot;: admission webhook &quot;pilot.validation.istio.io&quot; denied the request: configuration is invalid: envoy filter: missing filters
</code></pre>
<p>So, I realised that the EnvoyFilter configuration above is not supported by <code>istio 1.2.5</code>, so I modified the configuration to work with the old version:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-idle-timeout
spec:
  workloadSelector:
    labels:
      app: mecha-dev
  filters:
    - listenerMatch:
        listenerType: SIDECAR_OUTBOUND
        listenerProtocol: TCP
      filterName: envoy.tcp_proxy
      filterType: NETWORK
      filterConfig:
        idle_timeout: 5s
</code></pre>
<p>After modifying the EnvoyFilter was created but it does not seem to have any affect on the outbound requests. Also, I couldn't find a way to restrict this filter to only outbound requests going to external service <code>some.app.com</code>.</p>
<p>Is there something missing in my EnvoyFilter configuration? Also, can we restrict this filter to just <code>some.app.com</code>? There's <code>address</code> option under <code>listenerMatch</code> but what if the IP address of the external service keeps on changing?</p>
<p>Istio and EnvoyProxy version used:</p>
<pre><code>ISTIO_VERSION=1.2.5
ENVOY_VERSION=1.11.0-dev
</code></pre>

<p>This is a community wiki answer. Feel free to expand it.</p>
<p>As already discussed in the comments, the <code>EnvoyFilter</code> was not yet supported in Istio version 1.2 and actually that version is no longer in support since Dec 2019.</p>
<p>I strongly recommend upgrading to the latest Istio and Envoy versions. Also, after you upgrade please notice that the filter name you want to use was <a href="https://www.envoyproxy.io/docs/envoy/latest/version_history/v1.14.0#deprecated" rel="nofollow noreferrer">deprecated and replaced</a>. You should now use <code>envoy.filters.network.tcp_proxy</code> instead of <code>envoy.tcp_proxy</code>.</p>
<p>Please remember that things are getting deprecated for a reason and keeping the old versions will sooner or later bring you more trouble. Try to keep things more up-to-date.</p>
<p>More details can be found in the <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">latest docs</a>.</p>
