<p>I am trying to apply some of the <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge" rel="nofollow noreferrer">Envoy edge proxy best practice</a> configs to my Istio 1.9.0 deployment and I am struggling to get a successful EnvoyFilter in place. All ingress traffic returns 503 after I apply.</p>
<p>Using <code>istioctl</code> I see the configs are applied and proxy-status appears to be healthy… Any ideas?</p>
<pre><code>---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: connection-control
  namespace: istio-system
spec:
  configPatches:
  - applyTo: CLUSTER
    patch:
      operation: MERGE
      value:
        connect_timeout: 5s
        per_connection_buffer_limit_bytes: 32768 # 32 KiB
        http2_protocol_options:
          initial_stream_window_size: 65536 # 64 KiB
          initial_connection_window_size: 1048576 # 1 MiB
  - applyTo: NETWORK_FILTER
    match:      
      listener:
        filterChain:
          filter:
            name: &quot;envoy.filters.network.http_connection_manager&quot;
    patch:
      operation: MERGE
      value:
        typed_config:
          &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          common_http_protocol_options:
            idle_timeout: 3600s # 1 hour
            headers_with_underscores_action: REJECT_REQUEST
          http2_protocol_options:
            max_concurrent_streams: 100
            initial_stream_window_size: 65536 # 64 KiB
            initial_connection_window_size: 1048576 # 1 MiB
          stream_idle_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
          request_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
</code></pre>
<p>Note: I have scoured the net and tried basically every possible &quot;working&quot; solution. This config represents what I believe to be the most &quot;correct&quot; solution for 1.9.0. Flow control and connection buffer limiting should be trivial so I must be missing something small.</p>
<p>Thanks in advance for any advice!</p>

acumartini
<p>So after after some tweaking I finally got a working EnvoyFilter deployed:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: edge-proxy-protocol
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      # context omitted so that this applies to both sidecars and gateways
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          common_http_protocol_options:
            idle_timeout: 3600s # 1 hour
          http2_protocol_options:
            max_concurrent_streams: 100
            initial_stream_window_size: 65536 # 64 KiB
            initial_connection_window_size: 1048576 # 1 MiB
          stream_idle_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
          request_timeout: 300s # 5 mins, must be disabled for long-lived and streaming requests
</code></pre>
<p>However I was still seeing 30s timeouts on connections I wanted to remain open... turns out the there was a timeout at the global LB level. Mystery solved and EnvoyFilter working as designed.</p>
