<p>I am testing istio 1.10.3 to add headers with minikube but I am not able to do so.</p>
<p><strong>Istio</strong> is installed in the <code>istio-system</code> namespaces.
The namespace where the deployment is deployed is labeled with <code>istio-injection=enabled</code>.</p>
<p>In the <code>config_dump</code> I can see the LUA code only when the context is set to <code>ANY</code>. When I set it to <code>SIDECAR_OUTBOUND</code> the code is not listed:</p>
<pre><code>&quot;name&quot;: &quot;envoy.lua&quot;,
&quot;typed_config&quot;: {
&quot;@type&quot;: &quot;type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua&quot;,
&quot;inline_code&quot;: &quot;function envoy_on_request(request_handle)\n  request_handle:headers():add(\&quot;request-body-size\&quot;, request_handle:body():length())\nend\n\nfunction envoy_on_response(response_handle)\n  response_handle:headers():add(\&quot;response-body-size\&quot;, response_handle:body():length())\nend\n&quot;
}
</code></pre>
<p>Someone can give me some tips?</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: headers-envoy-filter
  namespace: nginx-echo-headers
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
       name: envoy.lua
       typed_config:
         '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
         inline_code: |
           function envoy_on_request(request_handle)
             request_handle:headers():add(&quot;request-body-size&quot;, request_handle:body():length())
           end

           function envoy_on_response(response_handle)
             response_handle:headers():add(&quot;response-body-size&quot;, response_handle:body():length())
           end
  workloadSelector:
    labels:
      app: nginx-echo-headers
      version: v1
</code></pre>
<p>Below is my deployment and Istio configs:</p>
<pre><code>---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-echo-headers-v1
  namespace: nginx-echo-headers
  labels:
    version: v1
spec:
  selector:
    matchLabels:
      app: nginx-echo-headers
      version: v1
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx-echo-headers
        version: v1
    spec:
      containers:
      - name: nginx-echo-headers
        image: brndnmtthws/nginx-echo-headers:latest
        ports:
          - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-echo-headers-svc
  namespace: nginx-echo-headers
  labels:
    version: v1
    service: nginx-echo-headers-svc
spec:
  type: ClusterIP
  ports:
  - name: http
    port: 80
    targetPort: 8080
  selector:
    app: nginx-echo-headers
    version: v1
---
# ISTIO GATEWAY
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: nginx-echo-headers-gateway
  namespace: istio-system
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - &quot;api.decchi.com.ar&quot;

# ISTIO VIRTUAL SERVICE
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-echo-headers-virtual-service
  namespace: nginx-echo-headers
spec:
  hosts:
  - 'api.decchi.com.ar'
  gateways:
  - istio-system/nginx-echo-headers-gateway
  http:
  - route:
      - destination:
          # k8s service name
          host: nginx-echo-headers-svc
          port:
            # Services port
            number: 80
          # workload selector
          subset: v1

## ISTIO DESTINATION RULE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx-echo-headers-dest
  namespace: nginx-echo-headers
spec:
  host: nginx-echo-headers-svc
  subsets:
    - name: &quot;v1&quot;
      labels:
        app: nginx-echo-headers
        version: v1
</code></pre>
<p>It is only working when I configure the context in <code>GATEWAY</code>. The <code>envoyFilter</code> is running in the <code>istio-system</code> namespace and the <code>workloadSelector</code> is configured like this:</p>
<pre><code>workloadSelector:
    labels:
      istio: ingressgateway
</code></pre>
<p>But my idea is to configure it in <code>SIDECAR_OUTBOUND</code>.</p>

Little crazy
<blockquote>
<p>it is only working when I configure the context in <strong>GATEWAY</strong>, the envoyFilter is running in the <strong>istio-system</strong> namespace</p>
</blockquote>
<p>That's correct! You should apply your <code>EnvoyFilter</code> in the config root namespace <code>istio-system</code>-  in your case.</p>
<p>And the most important part, just omit <code>context</code> field, when matching your <code>configPatches</code>, so that this applies to both sidecars and gateways. You can see the examples of usage in <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">this Istio Doc</a>.</p>
