<p>I have set up an <code>istio</code>-enabled microservices architecture on a <code>kubernetes</code> cluster.</p>
<p>My <code>istio-ingressgateway</code> is proxied by Cloudflare.</p>
<p>The later, generates a of specific header, namely <code>cf-ray</code> to support troubleshooting cloudflare-related issues.</p>
<p>My question is how to enable my service mesh i.e. both in the edge (the <code>istio-ingressgateway</code> that is) and all sidecars to propagate the <code>cf-ray</code> id header.</p>
<p><code>istio</code>'s documentation on <code>VirtualService</code> resource, in the <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers-HeaderOperations" rel="nofollow noreferrer">section</a> about <code>HeaderOperations</code>, lists 3 available actions, namely <code>set</code>, <code>add</code> and <code>remove</code>.</p>
<p><code>add</code> and <code>remove</code> seem to be the more unrelated to the action I want to perform, however <code>set</code> also seems to ask for a specific value to be set.</p>
<p>I just want a passthrough/propagation type of operation where <code>istio</code> upon seeing a <code>cf-ray</code> header, will pass it</p>
<p>a) in the cluster (when its about the ingress gateway)</p>
<p>b) from each sidecar to the main container (it goes without saying that in this case, it then becomes a responsibility of the main container's app to continue propagation from that point on)</p>

pkaramol
<p>You don't have the problem of the sidecars propagating the headers, because the sidecars do it by default. It's like when you have to configure tracing in Istio. You just generate and propagate some headers, and no need to do anything with the sidecars.</p>
<p>About the generation part, actually the field you want to use is <code>add</code>. <code>set</code> will change the header value by something else (e.g. you have a <code>set</code> for <code>foo: bar</code>, if you get a request with <code>foo: baz</code>, it will set to <code>foo: bar</code>). <code>add</code>, on the other hand, will add <code>cf-ray</code> to your requests.</p>
<p>About the part of how to get the request into the cluster, there should be no problems as at the edge, through <code>Gateway</code> you don't configure headers. So, it will just pass through to the service.</p>
<p><strong>EXAMPLE</strong></p>
<pre><code>...
spec:
  hosts:
  - service.namespace.svc.cluster.local
  http:
  - headers:
      request:
        add:
          key: &quot;value&quot;
    route:
    - destination:
        host: service.namespace.svc.cluster.local
...
</code></pre>
