<p>I need to route my traffic based on the headers using istio but this option is deprecated in istio1.6 version. Why control headers and routing is deprecated in istio?</p>

Mageshwaran Kct
<p>As mentioned in istio <a href="https://istio.io/latest/docs/tasks/policy-enforcement/control-headers/" rel="nofollow noreferrer">documentation</a></p>
<blockquote>
<p>The mixer policy is deprecated in Istio 1.5 and not recommended for production usage.</p>
<p>Consider using Envoy <a href="https://www.envoyproxy.io/docs/envoy/v1.13.0/intro/arch_overview/security/ext_authz_filter" rel="nofollow noreferrer">ext_authz</a> filter, <a href="https://www.envoyproxy.io/docs/envoy/v1.13.0/configuration/http/http_filters/lua_filter" rel="nofollow noreferrer">lua</a> filter, or write a filter using the <a href="https://github.com/envoyproxy/envoy-wasm/tree/master/test/extensions/filters/http/wasm/test_data" rel="nofollow noreferrer">Envoy-wasm sandbox</a>.</p>
</blockquote>
<p>Control headers and routing are not deprecated, it's just mixer which was used to do that. There are different ways to do that now, as mentioned above.</p>
<p>I'm not sure what exactly you want to do, but take a look at envoy filter and virtual service.</p>
<hr />
<h2>Envoy filter</h2>
<p>There is envoy filter which add some custom headers to all the outbound responses</p>
<pre><code>kind: EnvoyFilter
metadata:
  name: lua-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: &quot;envoy.http_connection_manager&quot;
            subFilter:
              name: &quot;envoy.router&quot;
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         &quot;@type&quot;: &quot;type.googleapis.com/envoy.config.filter.http.lua.v2.Lua&quot;
         inlineCode: |
            function envoy_on_response(response_handle)
                response_handle:logInfo(&quot; ========= XXXXX ========== &quot;)
                response_handle:headers():add(&quot;X-User-Header&quot;, &quot;worked&quot;)
            end
</code></pre>
<p>And tests from curl</p>
<pre><code>$ curl -s -I -X HEAD x.x.x.x/
HTTP/1.1 200 OK
server: istio-envoy
date: Mon, 06 Jul 2020 08:35:37 GMT
content-type: text/html
content-length: 13
last-modified: Thu, 02 Jul 2020 12:11:16 GMT
etag: &quot;5efdcee4-d&quot;
accept-ranges: bytes
x-envoy-upstream-service-time: 2
x-user-header: worked
</code></pre>
<p>Few links worth to check about that:</p>
<ul>
<li><a href="https://blog.opstree.com/2020/05/27/ip-whitelisting-using-istio-policy-on-kubernetes-microservices/" rel="nofollow noreferrer">https://blog.opstree.com/2020/05/27/ip-whitelisting-using-istio-policy-on-kubernetes-microservices/</a></li>
<li><a href="https://github.com/istio/istio/wiki/EnvoyFilter-Samples" rel="nofollow noreferrer">https://github.com/istio/istio/wiki/EnvoyFilter-Samples</a></li>
<li><a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">https://istio.io/latest/docs/reference/config/networking/envoy-filter/</a></li>
</ul>
<hr />
<h2>Virtual Service</h2>
<p>Another thing worth to check here would be <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service" rel="nofollow noreferrer">virtual service</a>, you can do header routing based on matches here.</p>
<p>Take a look at example from <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest" rel="nofollow noreferrer">istio documentation</a></p>
<blockquote>
<p>HttpMatchRequest specifies a set of criterion to be met in order for the rule to be applied to the HTTP request. For example, the following restricts the rule to match only requests where the URL path starts with /ratings/v2/ and <strong>the request contains a custom end-user header with value jason.</strong></p>
</blockquote>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings-route
spec:
  hosts:
  - ratings.prod.svc.cluster.local
  http:
  - match:
    - headers:
        end-user:
          exact: jason
      uri:
        prefix: &quot;/ratings/v2/&quot;
      ignoreUriCase: true
    route:
    - destination:
        host: ratings.prod.svc.cluster.local
</code></pre>
<p>Additionally there is my older <a href="https://stackoverflow.com/a/59841540/11977760">example</a> with header based routing in virtual service.</p>
<hr />
<p>Let me know if you have any more questions.</p>
