Envoy filters are used to configure filters and listeners for Envoy proxies to provide rich features for the control plane of an Alibaba Cloud Service Mesh (ASM) instance. This topic describes how to create, modify, and delete an Envoy filter.

Usage notes

The method for creating an Envoy filter varies with the version of your ASM instance.

  • If the version of your ASM instance is V1.12.4.0-g7d140f10-aliyun or later, you can create an Envoy filter by using an Envoy filter template.
  • If the version of your ASM instance is earlier than V1.12.4.0-g7d140f10-aliyun, you need to Submit a ticket to create an Envoy filter. You can also update your ASM instance to V1.12.4.0-g7d140f10-aliyun or later. Then, you can create an Envoy filter by using an Envoy filter template. For more information about how to update an ASM instance, see Update an ASM instance.

Relationships between Envoy filter templates and Envoy filters

User-created Envoy filters may be incompatible with ASM instances after the instances are updated or maintained. In an ASM instance of V1.12.4.0-g7d140f10-aliyun or later, you can create Envoy filters by using Envoy filter templates. After you update the ASM instance, the system automatically recreates or modifies the Envoy filters that were created by using Envoy filter templates to ensure that the Envoy filters are compatible with the ASM instance. This prevents version compatibility issues of Envoy filters and makes Envoy filters easier to use.

After you create an Envoy filter template, you must bind the Envoy filter template to a workload or namespace. Then, ASM automatically creates an Envoy filter by using the template. An Envoy filter template can be bound to multiple workloads and namespaces. This way, you can create multiple Envoy filters by using the template.

Create an Envoy filter template

ASM allows you to create an Envoy filter template by using a preset template or by customizing the Envoy filter template.

Create an Envoy filter template by using a preset template

  1. Log on to the ASM console.
  2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
  4. On the details page of the ASM instance, choose Plugin Center > EnvoyFilter in the left-side navigation pane.
  5. On the EnvoyFilter page, click Create EnvoyFilter Template.
  6. On the User builtin EnvoyFilter template tab, select a preset template and click Next.
  7. Click Fill template parameters, set the template parameters, and then click OK.
  8. In the Basic Information section, select a namespace for the Envoy filter template, enter the name of the Envoy filter template, and then click Create.
    In the Multi-version adapted EnvoyFilter templates section, you can view the YAML content of the Envoy filter template that is adapted to Istio 1.10, 1.11, and 1.12.

Create an Envoy filter template by customizing the template

  1. Log on to the ASM console.
  2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
  4. On the details page of the ASM instance, choose Plugin Center > EnvoyFilter in the left-side navigation pane.
  5. On the EnvoyFilter page, click Create EnvoyFilter Template.
  6. On the Create page, click the Customize EnvoyFilter template tab.
  7. In the Basic Information section, select a namespace for the Envoy filter template and enter the name of the Envoy filter template.
  8. In the Multi-version adapted EnvoyFilter templates section, click Add an EnvoyFilter template for specific adapted istio version, select an Istio version, set the parameters, and then click Create.

Bind an Envoy filter template to a workload or namespace

After you create an Envoy filter template, you must bind the Envoy filter template to workloads or namespaces. Then, the Envoy filter template takes effects on the specified workloads or namespaces. After you bind the Envoy filter template to workloads or namespaces, ASM automatically creates Envoy filters by using the template.

Bind an Envoy filter template to a workload

  1. Log on to the ASM console.
  2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
  4. On the details page of the ASM instance, choose Plugin Center > EnvoyFilter in the left-side navigation pane.
  5. On the EnvoyFilter page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
  6. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and click Bind EnvoyFilter to Workloads.
  7. In the Bind EnvoyFilter to Workloads dialog box, set the Namespace and Workload Type parameters, click Bind next to a workload in the Not bound section, and then click OK.
    Return to the EnvoyFilter page and click the EnvoyFilter tab. The automatically created Envoy filter is displayed.

Bind an Envoy filter template to a namespace

  1. Log on to the ASM console.
  2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
  3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
  4. On the details page of the ASM instance, choose Plugin Center > EnvoyFilter in the left-side navigation pane.
  5. On the EnvoyFilter page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
  6. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and click Bind EnvoyFilter to Namespace.
  7. In the Bind EnvoyFilter to Namespace dialog box, click the namespace that you want to configure in the Not bound section and click OK.
    Note If you bind an Envoy filter template to the istio-system namespace, the Envoy filter template globally takes effect. The Envoy filter template is automatically unbound from other workloads or namespaces to which the template is bound. Therefore, you need to confirm that you want to bind Envoy filter template to the istio-system namespace.
    Return to the EnvoyFilter page and click the EnvoyFilter tab. The automatically created Envoy filter is displayed.

What to do next

Modify an Envoy filter

Note You can modify only Envoy filters that are created by using custom templates. You cannot modify Envoy filters that are created by using preset templates.

On the EnvoyFilter page, find the Envoy filter template that you want to modify and click Edit template in the Actions column. Modify the template parameters and click Modify template contents. After you modify the Envoy filter template, the Envoy filters that were created by using the template are automatically updated.

Delete an Envoy filter

  • Delete an Envoy filter by deleting an Envoy filter template

    On the EnvoyFilter page, find the Envoy filter template that you want to delete and click Delete in the Actions column. In the message that appears, click OK. After you delete the Envoy filter template, the Envoy filters that were created from the template are automatically deleted.

  • Delete an Envoy filter by unbinding an Envoy filter template from a workload

    On the EnvoyFilter page, find the Envoy filter template that you want to configure and click Edit template in the Actions column. On the Bind template to workloads tab, click Bind EnvoyFilter to Workloads. In the Bind EnvoyFilter to Workloads dialog box, click Unbind next to the workload from which you want to unbind the template and click OK. After you unbind the Envoy filter template from the workload, the Envoy filter that was created by using the template for the workload is automatically deleted.

  • Delete an Envoy filter by unbinding an Envoy filter template from a namespace

    On the EnvoyFilter page, find the Envoy filter template that you want to configure and click Edit template in the Actions column. On the Bind template to workloads tab, click Bind EnvoyFilter to Namespace. In the Bind EnvoyFilter to Namespace dialog box, click the namespace from which you want to unbind the template in the Bound section and click OK. After you unbind the Envoy filter template from the namespace, the Envoy filter that was created by using the template for the namespace is automatically deleted.