Envoy Filter

Applies envoy config patches to a workload

Demo Setup

. ./setup.sh
kubectl port-forward deploy/productpage-v1 9080 &

Apply filter:

kubectl apply -f envoyfilter.yaml

Curl product page

curl -v http://localhost:9080/api/v1/products/0/reviews

curl -v http://localhost:9080/api/v1/products/1/reviews
for i in $(seq 100); do curl -s http://localhost:9080/api/v1/products/1/reviews > /dev/null; done
curl -v http://localhost:9080/api/v1/products/1/reviews

Debugging

Port forward debug ports

kubectl port-forward deploy/productpage-v1 15000 &
kubectl port-forward deploy/reviews-v1 15001:15000 &
kubectl port-forward deploy/ratelimit 6070:6070 &

See redis state:

for key in $(kubectl exec deploy/redis -- redis-cli keys '*'); do
    echo $key
    kubectl exec deploy/redis -- redis-cli get $key
done

Enable debug log level:

curl -XPOST "localhost:15000/logging?level=debug"
curl -XPOST "localhost:15001/logging?level=debug"

Config dump:

curl "localhost:15001/config_dump"

Get envoy logs

kubectl logs -f --tail=10 deploy/productpage-v1 -c istio-proxy
kubectl logs -f --tail=10 deploy/reviews-v1 -c istio-proxy

Config Change

When changing rate limit config in srvconfig.yaml, restart it to apply the new config:

kubectl apply -f srvconfig.yaml
kubectl rollout restart deployment ratelimit

Reference docs: https://istio.io/latest/docs/reference/config/networking/envoy-filter/ https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/