如何在 Istio 中调试 EnvoyFilter？

Question

我有以下过滤器：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: proper-filter-name-here
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.http_connection_manager"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.lua
          typed_config:
            "@type": "type.googleapis.com/envoy.config.filter.http.lua.v2.Lua"
            inlineCode: |
              function envoy_on_request(request_handle)
                 request_handle:logDebug("Hello World!")
              end

我正在检查网关的日志，它没有看起来像是应用了过滤器。如何调试 EnvoyFilter？我在哪里可以看到每个请求应用了哪些过滤器？

Answer 1

这个主题在 the documentation 中有很好的描述：

The simplest kind of Istio logging is Envoy’s access logging. Envoy proxies print access information to their standard output. The standard output of Envoy’s containers can then be printed by the kubectl logs command.

您问过：

Where can I see what filters are applied each request?

基于this issue on github:

There is no generic mechanism.

因此，如果您想查看对每个请求应用了什么过滤器，则必须创建您的自定义解决方案。

但是，没有任何问题，您可以根据 this fragment in the documentation:

获取有关每个请求的日志

If you used an IstioOperator CR to install Istio, add the following field to your configuration:

spec:
  meshConfig:
    accessLogFile: /dev/stdout

Otherwise, add the equivalent setting to your original istioctl install command, for example:

istioctl  install  <flags-you-used-to-install-Istio> --set meshConfig.accessLogFile=/dev/stdout

You can also choose between JSON and text by setting accessLogEncoding to JSON or TEXT. You may also want to customize the format of the access log by editing accessLogFormat.

Refer to global mesh options for more information on all three of these settings:

meshConfig.accessLogFile
meshConfig.accessLogEncoding
meshConfig.accessLogFormat

您还可以 change access log format and test the access log 从链接的说明。

另见（编辑）：

How to debug your Istio networking configuration:

EnvoyFilters will manifest where you tell Istio to put them. Typically a bad EnvoyFilter will manifest as Envoy rejecting the configuration (i.e. not being in the SYNCED state above) and you need to check Istiod (Pilot) logs for the errors from Envoy rejecting the configuration.

If configuration didn’t appear in Envoy at all– Envoy did not ACK it, or it’s an EnvoyFilter configuration– it’s likely that the configuration is invalid (Istio cannot syntactically validate the configuration inside of an EnvoyFilter) or is located in the wrong spot in Envoy’s configuration.

如何在 Istio 中调试 EnvoyFilter？

How to debug an EnvoyFilter in Istio?

debugging

istio

envoyproxy