Alibaba Cloud Service Mesh:Migrate common Nginx configurations to an ASM gateway

Nginx configuration

Description

ASM gateway equivalent

allow-backend-server-header

Allows the backend to return the Server header instead of a generic Nginx string.

The ASM gateway enables this by default.

allow-snippet-annotations

Allows using custom snippets in an Ingress annotation to modify the Nginx configuration.

An ASM gateway does not support this setting. In an ASM gateway, you must modify the gateway configuration by editing the IstioGateway YAML file.

compute-full-forwarded-for

Appends the remote address to the X-Forwarded-For header instead of replacing it.

This behavior depends on the Envoy use_remote_address setting, which defaults to true. For more information about how Istio handles the X-Forwarded-For header, see Configuring Gateway Network Topology.

enable-underscores-inheaders

Allows underscores in header names.

This maps to the Envoy headers_with_underscores_action setting, which allows underscores by default.

forwarded-for-header

Specifies the header field used to identify the client's original IP address.

An ASM gateway does not support a custom header for this purpose. It uses X-Forwarded-For by default.

generate-request-id

Generates a random X-Request-ID if one is not present in the request.

This maps to the Envoy generate_request_id setting, which is enabled by default. You can modify this setting by using an ASM plugin.

ignore-invalid-headers

Determines whether to ignore headers with invalid names. A valid header name consists of alphanumeric characters and hyphens (-). It may also include underscores (_).

Envoy provides a Header Validator. If you do not configure the Header Validator, Envoy uses a default one. Envoy rejects requests with invalid headers with a Bad Request error.

~ $ curl httpbin:8000/headers -H "test-@@@:test" -I
HTTP/1.1 400 Bad Request
content-length: 11
content-type: text/plain
date: Tue, 01 Aug 2023 06:14:20 GMT
server: istio-envoy
connection: close

keep-alive-requests

Sets the maximum number of requests that can be served through a single keepalive connection. After the maximum number is reached, the connection is closed.

To configure this, see the connectionPool.maxRequestsPerConnection field in a DestinationRule.

log-format-upstream

Customizes the log format.

An ASM gateway supports custom log formats. You can configure the format on the Observability settings page in the ASM console. For more information, see Observability settings.

max-worker-connections

Sets the maximum number of connections that a single worker process can open.

ASM does not provide a direct equivalent. However, you can use the connectionPool.tcp.maxConnections field in a DestinationRule to configure the maximum number of connections to a single host.

proxy-body-size

Sets the maximum allowed size of the client request body. If the request body exceeds this size, the server returns a 413 error.

You cannot configure this setting directly. Use chunked transfer encoding for large bodies.

proxy-connect-timeout

Defines the timeout for establishing a connection with a proxy server. This cannot exceed 75 seconds.

To configure this, see the connectionPool.http.connectTimeout field in a DestinationRule.

reuse-port

Creates a separate listening socket for each worker process (using the SO_REUSEPORT socket option), which allows the kernel to load balance incoming connections across worker processes. This is enabled by default.

The ASM gateway enables this by default.

server-tokens

Sends the Nginx server header in responses and displays the Nginx version on error pages. This is disabled by default.

An ASM gateway sets the server header to Envoy by default, but the Envoy version is not displayed on error pages.

ssl-redirect

If a server is secured with a TLS certificate, this setting automatically redirects HTTP traffic to HTTPS.

To configure this, see the tls.httpsRedirect field in a Gateway.

upstream-keepalive-connections

Sets the maximum number of idle keepalive connections to upstream servers that are preserved in each worker process's cache.

ASM does not provide a direct equivalent. The DestinationRule provides the connectionPool.tcp.maxConnections field, which has a similar purpose. However, the Istio setting applies to all connections, whereas the Nginx setting applies only to idle connections.

upstream-keepalive-timeout

Sets a timeout after which the system closes an idle keepalive connection to an upstream server.

To configure this, see the connectionPool.http.idleTimeout field in a DestinationRule.

use-forwarded-headers

• If true, Nginx passes the incoming X-Forwarded-* headers to the upstream server. This is typically used when Nginx is behind another L7 proxy.

• If false, Nginx ignores the incoming headers and generates its own.

For more information about how Istio handles the X-Forwarded-For header, see Configuring Gateway Network Topology.

worker-cpu-affinity

Binds worker processes to specific sets of CPUs.

In a container environment, we do not recommend configuring this option. Using the default setting is sufficient.