<p>I am running Istio 1.6.0.
I wanted to add some custom headers to all the outbound responses originating from my service. So I was trying to use lua <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">envoyfilter</a> to achieve that. However, I don't see my proxy getting properly configured.</p>
<p>The envoy filter config that I'm trying to use is</p>
<pre><code>kind: EnvoyFilter
metadata:
  name: lua-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: &quot;envoy.http_connection_manager&quot;
            subFilter:
              name: &quot;envoy.router&quot;
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         &quot;@type&quot;: &quot;type.googleapis.com/envoy.config.filter.http.lua.v2.Lua&quot;
         inlineCode: |
            function envoy_on_response(response_handle)
                response_handle:logInfo(&quot; ========= XXXXX ========== &quot;)
                response_handle:headers():add(&quot;X-User-Header&quot;, &quot;worked&quot;)
            end
</code></pre>
<p>I do have my ingress-gateway pods running in the <code>istio-system</code> namespace</p>
<pre><code>❯ kgp -l istio=ingressgateway -n istio-system
NAME                              READY   STATUS    RESTARTS   AGE
ingress-gateway-b4b5cffc9-wz75r   1/1     Running   0          3d12h
ingress-gateway-b4b5cffc9-znx9b   1/1     Running   0          28h
</code></pre>
<p>I was hoping that I would see <code>X-User-Header</code> when I curl for my service.
Unfortunately, I'm not seeing any custom headers.</p>
<p>I tried checking the <code>proxy-configs</code> of the ingress-gateway pod in the istio-system, and I don't see the <code>envoy.lua</code> configured at all. I'm not sure whether I'm debugging it correctly.</p>
<pre><code> istioctl proxy-config listener ingress-gateway-b4b5cffc9-wz75r.istio-system  -n istio-system --port 443 -o json | grep &quot;name&quot;
        &quot;name&quot;: &quot;0.0.0.0_443&quot;,
                        &quot;name&quot;: &quot;istio.stats&quot;,
                        &quot;name&quot;: &quot;envoy.tcp_proxy&quot;,
                        &quot;name&quot;: &quot;istio.stats&quot;,
                        &quot;name&quot;: &quot;envoy.tcp_proxy&quot;,
                &quot;name&quot;: &quot;envoy.listener.tls_inspector&quot;,
</code></pre>
<p>Please let me know what is that I'm missing or incorrectly configured.
Any advice on how to debug further also would be really helpful.</p>
<p>Thank you so much.</p>

PDP
<p>As far as I checked on my istio cluster with version 1.6.3 and 1.6.4 your example works just fine. Take a look at below code from my cluster.</p>
<p>I checked it with curl</p>
<pre><code>$ curl -s -I -X HEAD x.x.x.x/
HTTP/1.1 200 OK
server: istio-envoy
date: Mon, 06 Jul 2020 08:35:37 GMT
content-type: text/html
content-length: 13
last-modified: Thu, 02 Jul 2020 12:11:16 GMT
etag: &quot;5efdcee4-d&quot;
accept-ranges: bytes
x-envoy-upstream-service-time: 2
x-user-header: worked
</code></pre>
<p><strong>AND</strong></p>
<p>I checked it with config_dump in istio ingress-gateway pod.</p>
<p>I exec there with</p>
<pre><code>kubectl exec -ti istio-ingressgateway-78db9f457d-xfhl7  -n istio-system -- /bin/bash 
</code></pre>
<p>Results from config_dump</p>
<pre><code>curl 0:15000/config_dump | grep X-User-Header
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  128k    0  128k    0     0  9162k      0 --:--:-- --:--:-- --:--:-- 9162k
               &quot;inline_code&quot;: &quot;function envoy_on_response(response_handle)\n    response_handle:logInfo(\&quot; ========= XXXXX ========== \&quot;)\n    response_handle:headers():add(\&quot;X-User-Header\&quot;, \&quot;worked\&quot;)\nend\n&quot;
</code></pre>
<p>So as you can see it works, header is added to request and function is active in istio ingress gateway.</p>
<hr />
<p>Could you try to check it again with above curl, check istio ingress-gateway tcp_dump and let me know if it works for you?</p>
