Envoy filters are used to configure settings, such as settings for filter conditions and listeners, for Envoy proxies. This further enhances capabilities of the Alibaba Cloud Service Mesh (ASM) control plane. This topic describes how to create, modify, and delete an Envoy filter.

Precautions

The method for creating an Envoy filter varies with the Istio version of your ASM instance:

  • If the Istio version of your ASM instance is V1.12.4.0-g7d140f10-aliyun or later, create an Envoy filter by using an Envoy filter template.
  • If the Istio version of the ASM instance is earlier than v1.12.4.0-g7d140f10-aliyun, update the ASM instance version to v1.12.4.0-g7d140f10-aliyun or later. Then, use an Envoy filter template to create an Envoy filter. For more information about how to update an ASM instance, see Update an ASM instance.

Relationships between Envoy filter templates and Envoy filters

Self-managed Envoy filters may be incompatible with ASM instances after the instances are updated or maintained. In an ASM instance of V1.12.4.0-g7d140f10-aliyun or later, you can create Envoy filters by using Envoy filter templates. After you update the ASM instance, the system automatically creates new Envoy filters or modifies the existing Envoy filters by using Envoy filter templates to ensure that the Envoy filters are compatible with the ASM instance. This prevents version compatibility issues of Envoy filters and makes Envoy filters easier to use.

After you create an Envoy filter template, you must bind the Envoy filter template to a workload or namespace. Then, ASM automatically creates an Envoy filter by using the template. An Envoy filter template can be bound to multiple workloads and namespaces. This way, you can create multiple Envoy filters by using the template.

Create an Envoy filter template

  1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template. On the page that appears, click Create EnvoyFilter Template.
  3. On the EnvoyFilter Template page, click Create EnvoyFilter Template.
  4. In the Basic Information section, enter a name for the Envoy filter template.
  5. In the Multi-version adapted EnvoyFilter templates section, click Add an EnvoyFilter template for specific adapted istio version, select an Istio version, configure the parameters, and then click Create.
    After you create an Envoy filter template, you can view the Envoy filter template on the EnvoyFilter Template page.

Bind an Envoy filter template to a workload or namespace

After you create an Envoy filter template, you must bind the Envoy filter template to workloads or namespaces. Then, the Envoy filter template takes effects on the specified workloads or namespaces. After you bind the Envoy filter template to workloads or namespaces, ASM automatically creates Envoy filters by using the template.

Bind an Envoy filter template to a workload

  1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template.
  3. On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
  4. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and click Bind EnvoyFilter to Workloads.
  5. In the Bind EnvoyFilter to Workloads dialog box, set the Namespace and Workload Type parameters, click Bind next to a workload in the Not bound section, and then click OK.
    On the details page of the ASM instance, choose Plugin Extension Center > EnvoyFilter in the left-side navigation pane. On the EnvoyFilter page, you can view the Envoy filter that is automatically created.

Bind an Envoy filter template to a namespace

  1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template.
  3. On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
  4. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and click Bind EnvoyFilter to Namespace.
  5. In the Bind EnvoyFilter to Namespace dialog box, click the namespace that you want to configure in the Not bound section and click OK.
    Note If you bind an Envoy filter template to the istio-system namespace, the Envoy filter template globally takes effect. The Envoy filter template is automatically unbound from other workloads or namespaces to which the template is bound. Therefore, you need to confirm that you want to bind Envoy filter template to the istio-system namespace.
    On the details page of the ASM instance, choose Plugin Extension Center > EnvoyFilter in the left-side navigation pane. On the EnvoyFilter page, you can view the Envoy filter that is automatically created.

Related operations

Modify an Envoy filter

Note You can modify only Envoy filters that are created by using custom templates. You cannot modify Envoy filters that are created by using preset templates. An Envoy filter template that is displayed as an ASM plug-in on the EnvoyFilter Template page is a preset template.

On the EnvoyFilter Template page, find the Envoy filter template that you want to modify and click Edit template in the Actions column. Modify the template parameters and click Modify template contents. After you modify the Envoy filter template, the Envoy filters that were created by using the template are automatically updated.

Delete an Envoy filter

  • Delete an Envoy filter by deleting an Envoy filter template

    On the EnvoyFilter Template page, find the Envoy filter template that you want to delete and click Delete in the Actions column. In the message that appears, click OK. After you delete the Envoy filter template, the Envoy filters that were created by using the template are automatically deleted.

  • Delete an Envoy filter by unbinding an Envoy filter template from a workload

    On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column. On the Bind template to workloads tab, click Bind EnvoyFilter to Workloads. In the Bind EnvoyFilter to Workloads dialog box, click Unbind next to the workload from which you want to unbind the template and click OK. After you unbind the Envoy filter template from the workload, the Envoy filter that was created for the workload by using the template is automatically deleted.

  • Delete an Envoy filter by unbinding an Envoy filter template from a namespace

    On the EnvoyFilter page, find the Envoy filter template that you want to configure and click Edit template in the Actions column. On the Bind template to workloads tab, click Bind EnvoyFilter to Namespace. In the Bind EnvoyFilter to Namespace dialog box, click the namespace from which you want to unbind the template in the Bound section and click OK. After you unbind the Envoy filter template from the namespace, the Envoy filter that was created for the namespace by using the template is automatically deleted.