<p>I'm trying to set a simple HTTP filter through Envoy Filter. I'm using a brand new EKS cluster made with Terraform, and Istio installed with Helm to its latest version and default values.</p>
<p>I'm trying to reach a simple python script which receive an http request and print the header.</p>
<p>Below, the resources I'm using..</p>
<p>The python script:</p>
<pre class="lang-py prettyprint-override"><code>    from flask import Flask, redirect, url_for, request, Response
    import logging
    app = Flask(__name__)
    
    @app.route('/status', methods=['GET', 'POST'])
    def parse_request():
        data = request.data  # data is empty
        # need posted data here
        headers = request.headers
        print(headers)
        app.logger.info(headers)
        status_code = Response(status=200)
        return status_code
    
    if __name__ == '__main__':
        app.run(app.run(debug=True, port=5000, host='0.0.0.0'))
</code></pre>
<p>The K8s manifests:</p>
<ol>
<li>Deployment</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: http
  labels:
    app: http
spec:
  replicas: 1
  selector:
    matchLabels:
      app: http
  template:
    metadata:
      labels:
        app: http
        run: http_pod
    spec:
      containers:
      - image: flask_http_test:latest
        imagePullPolicy: Always
        name: http
        ports:
        - containerPort: 5000
      restartPolicy: Always
      imagePullSecrets:
      - name: regcred
</code></pre>
<ol start="2">
<li>Gateway &amp; VirtualService</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mygateway
  labels:
    app: http
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - &quot;*&quot;
--- 
kind: VirtualService
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: http-service-vs
  namespace: http
  labels:
    app: http
spec:
  hosts:
    - &quot;*&quot;   # host name of api
  gateways:
  - mygateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: http-service-svc  # k8s service name
        port:
            number: 5000     # pod port
EOF
</code></pre>
<ol start="3">
<li>Envoy Filter</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: http-service-svc-header-filter
  namespace: http
spec:
  workloadLabels:
    app: http-service-svc
    namespace: http
  filters:
  - listenerMatch:
      portNumber: 5000
      listenerType: SIDECAR_INBOUND 
      listenerProtocol: HTTP
    filterName: envoy.lua
    filterType: HTTP
    filterConfig:
      inlineCode: |
          function envoy_on_request(request_handle)
                request_handle:headers():add(&quot;newheader&quot;, &quot;it works!&quot;)
            end
</code></pre>
<p>I can reach my service through the Istio Ingress Gateway but the problem is that the filter completely ignored. I've also tried to define the add the filter in the istio-system namespace, without a workloadSelector, but its still ignored.</p>
<p>Does anybody have any idea on where could be the problem?</p>

Rosario Laface
<p>The problem is that you are applying an old EnvoyFilter api version that is not supported with istio 1.9.</p>
<p>See <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">EnvoyFilter docs</a> for reference</p>
<p>This should work:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: http-service-svc-header-filter
  namespace: http
spec:
  workloadSelector:
    labels:
      app: http
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        portNumber: 5000
        filterChain:
          filter:
            name: &quot;envoy.filters.network.http_connection_manager&quot;
            subFilter:
              name: &quot;envoy.filters.http.router&quot;
    patch:
      operation: INSERT_BEFORE
      value: 
       name: envoy.lua
       typed_config:
          &quot;@type&quot;: &quot;type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua&quot;
          inlineCode: |
            function envoy_on_request(request_handle)
              request_handle:headers():add(&quot;newheader&quot;, &quot;it works!&quot;)
            end
</code></pre>
