<p>I have a K8s Cluster, exposed its address using the command : <code>kubectl get svc istio-ingressgateway -n istio-system</code> -&gt; Let's assume the address was <code>a467.kongz.com</code></p>
<p>There's an Envoyfilter in my cluster that utilizes <strong>ExtAuth</strong> and attaches an extra header <code>Is-Kong-Verified</code> to the response headers
Consider Something similar to this -&gt; (<a href="https://stackoverflow.com/a/67350456/10858217">https://stackoverflow.com/a/67350456/10858217</a>)</p>
<p>Now when I make an API call to -&gt; <code>curl -v a467.kongz.com/stream/1</code>
This reaches External Auth System and the response header has the <code>Is-Kong-Verified</code> attached and then finally reaches the Upstream Service <strong><code>Kong Stream</code> Service  Pod(/stream/1)</strong></p>
<p>Now when I make calls to the <strong>Kong Stream Service</strong> which is exposed to the Public via Ingress as <a href="https://stream.kongz.com/stream/1" rel="nofollow noreferrer">https://stream.kongz.com/stream/1</a>, the Request is not being picked up by the Envoy Filter but reaches the end service.</p>
<p><strong>End Goal</strong></p>
<p><em>Need the EnvoyFilter to be applied on all incoming requests inside the cluster, even if the Service is directly requested</em></p>
<p>NOTE: The target Service/deployment has Istio-Sidecar injected</p>
<p>I have checked a few documents and realized that there should be a Gateway Service like Ambassador, Nginx that acts as a Proxy to the services. So when the client/user makes calls to the Nginx Proxy it routes the traffic to the ALB or Cluster Address then it goes through the EnvoyFilter and then reaches the Upstream Service.</p>
<p>Is it possible to achieve the end goal without any proxy system(nginx, ambassdor) or am I missing something?</p>
<p>Thanks in Advance for the answer.</p>

Krishna Manohar
<p>Finally, I have found a solution for my query</p>
<p>As compared to the <code>spec.configPatches.context=GATEWAY</code> configuration in the following doc
<a href="https://stackoverflow.com/questions/67347469/envoy-filter-to-intercept-upstream-response/67350456#67350456">envoy filter to intercept upstream response</a></p>
<p>It should be changed to <code>spec.configPatches.context=SIDECARD_INBOUND</code>
and the workload selector needs to be changed to the labels that match target pods under any namespace</p>
<p>Use the following doc for gaining more context
<a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/#EnvoyFilter-PatchContext" rel="nofollow noreferrer">https://istio.io/latest/docs/reference/config/networking/envoy-filter/#EnvoyFilter-PatchContext</a></p>
<p>Now this will allow the API calls to the specific service via Ingress intercepted by the Envoy Filter</p>
<p><strong>Make sure the Pods have the label that matches the Workload Selector <code>spec.workloadSelector.labels</code></strong>
For Instance, it should be similar to the one as follows</p>
<pre><code>spec:
  workloadSelector:
    labels:
      externalAuth: enabled
</code></pre>
<p>And your Pod(s) have the label <strong><code>externalAuth: enabled</code></strong></p>
