All Products
Search

This Product

    Alibaba Cloud Service Mesh:Create an Envoy filter from a template

    Document Center

    Alibaba Cloud Service Mesh:Create an Envoy filter from a template

    Last Updated:Aug 28, 2026

    Create Envoy filters from an Envoy filter template to apply one filter configuration to multiple workloads and namespaces in Service Mesh (ASM). Managing Envoy filters through a template improves configuration reuse, keeps filters aligned with the mesh version across upgrades, and reduces the complexity and potential errors of manual maintenance.

    Prerequisites

    Envoy filter templates and Envoy filters

    An Envoy filter template and an Envoy filter form an abstraction-and-instantiation pair. The template is the blueprint that specifies the configuration and the parameters required to create an Envoy filter that actually runs.

    • Envoy filter template — A predefined configuration structure that contains all the rules and parameter templates required to create an Envoy filter. The template defines how traffic that passes through the Envoy proxy is processed, but the template itself is not applied to traffic.

    • Envoy filter — The configuration entity that is created from a template and applied to the Envoy proxies in a service mesh to filter and process the traffic that passes through the proxies. An Envoy filter is a specific instance of the template, and it applies the rules and parameters of the template to real service traffic.

    Envoy filters carry version compatibility risks, so Envoy filters that you create on your own make mesh upgrades and maintenance much more difficult. Starting with ASM 1.12.4.0, you can create Envoy filters by managing Envoy filter templates instead. When the Service Mesh instance is upgraded, the Envoy filter template automatically creates or changes the corresponding Envoy filters based on the adapted version. This controls the version compatibility risks of Envoy filters and lowers the barrier to using them.

    Binding instantiates the template. ASM creates the corresponding Envoy filter automatically for each workload or namespace that you bind, so you can bind one Envoy filter template to multiple workloads and namespaces and create multiple Envoy filters from it.

    Step 1: Create an Envoy filter template

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template. On the page that appears, click Create EnvoyFilter Template.

    3. On the Create page, in the Basic Information section, enter a name for the Envoy filter template.

    4. In the Multi-version adapted EnvoyFilter templates section, click Add an EnvoyFilter template for specific adapted istio version., select an Adapted istio version, enter the Envoy filter content that is adapted to that version, and then click Create.

      • If your ASM instance runs version 1.18.0.146 or later, No Minimum Version Limit and No Maximum Version Limit are selected by default in the Adapted istio version section. To customize the Istio version range, clear No Minimum Version Limit or No Maximum Version Limit, and then enter the custom version.

      • For configuration examples and field descriptions of Envoy filters, see Envoy Filter.

      Verify that the new Envoy filter template appears on the EnvoyFilter Template page.

    Step 2: Bind an Envoy filter template to a workload or namespace

    Bind the Envoy filter template to a workload or a namespace so that the Envoy filter takes effect only on that workload or namespace. Before you start, make two decisions:

    • Binding scope — Bind a workload when the Envoy filter must take effect on that single workload. Bind a namespace when the Envoy filter must take effect on the whole namespace. Binding the istio-system namespace makes the Envoy filter take effect globally.

    • ASM instance version — The console entry point for binding differs between instances earlier than 1.18.0.146 and instances 1.18.0.146 or later. Check the version of your ASM instance, and then follow the matching procedure.

    ASM instance versions earlier than 1.18.0.146

    Bind an Envoy filter template to a workload

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template.

    3. On the EnvoyFilter Template page, find the Envoy filter template that you want to bind and click Edit template in the Actions column.

    4. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab, and then click Bind EnvoyFilter to Workloads.

    5. In the Bind EnvoyFilter to Workloads dialog box, select a Namespaces and a Workload Type, click Bind to the right of the workload that you want to bind in the Not bound section, and then click OK.

      Verify that the Envoy filter is created. In the left-side navigation pane of the mesh details page, choose Plugin Extension Center > EnvoyFilter. The Envoy filter that is created automatically appears on the EnvoyFilter page.

    Bind an Envoy filter template to a namespace

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template.

    3. On the EnvoyFilter Template page, find the Envoy filter template that you want to bind and click Edit template in the Actions column.

    4. On the Edit EnvoyFilter Template page, click the Bind template to workloads tab, and then click Bind namespace.

    5. In the Not bound section of the Bind namespace dialog box, click the name of the namespace that you want to bind, and then click OK.

      Warning

      If you bind the istio-system namespace, the Envoy filter takes effect globally and all the other bindings that you have created are unbound automatically. Confirm whether to bind istio-system before you proceed.

    6. Verify that the Envoy filter is created. In the left-side navigation pane of the mesh details page, choose Plugin Extension Center > EnvoyFilter. The Envoy filter that is created automatically appears on the EnvoyFilter page.

    ASM instance versions 1.18.0.146 or later

    Bind an Envoy filter template to a workload

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template.

    3. On the EnvoyFilter Template page, find the Envoy filter template that you want to bind and click Edit template in the Actions column.

    4. At the bottom of the Edit EnvoyFilter Template page, view the Bind template to workloads section.

      • If the page displays the message The EnvoyFilter template has adapted this version, but the correspond EnvoyFilters has not been created., click Create on the right.

    5. In the Bind template to workloads section, click Bind EnvoyFilter to Workloads. In the Bind EnvoyFilter to Workloads dialog box, select a Namespaces and a Workload Type. In the Actions column of the Not bound section, click Bind for the workload that you want to bind, and then click OK.

      Verify that the Envoy filter is created. In the left-side navigation pane of the mesh details page, choose Plugin Extension Center > EnvoyFilter. The Envoy filter that is created automatically appears on the EnvoyFilter page.

    Bind an Envoy filter template to a namespace

    1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

    2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Plugin Extension Center > EnvoyFilter Template.

    3. On the EnvoyFilter Template page, find the Envoy filter template that you want to bind and click Edit template in the Actions column.

    4. At the bottom of the Edit EnvoyFilter Template page, view the Bind template to workloads section.

      • If the page displays the message The EnvoyFilter template has adapted this version, but the correspond EnvoyFilters has not been created., click Create on the right.

    5. In the Bind template to workloads section, click Bind namespace. In the Not bound section of the Bind namespace dialog box, click the name of the namespace that you want to bind, and then click OK.

      Warning

      If you bind the istio-system namespace, the Envoy filter takes effect globally and all the other bindings that you have created are unbound automatically. Confirm whether to bind istio-system before you proceed.

    6. Verify that the Envoy filter is created. In the left-side navigation pane of the mesh details page, choose Plugin Extension Center > EnvoyFilter. The Envoy filter that is created automatically appears on the EnvoyFilter page.