How do I configure a Kubernetes networking.istio.io EnvoyFilter with Pulumi?

In this guide, we will configure an EnvoyFilter for Istio workloads using Pulumi. The EnvoyFilter resource allows you to customize the behavior of the Envoy proxy used by Istio. We will define an EnvoyFilter to modify the HTTP headers of incoming requests.

Key Points:

Pulumi and Kubernetes Integration: We will use Pulumi’s Kubernetes provider to manage Kubernetes resources.
Istio EnvoyFilter: We will create an EnvoyFilter to manipulate HTTP headers.
TypeScript: The code will be written in TypeScript.

Steps:

Import the necessary Pulumi and Kubernetes packages.
Define the Kubernetes namespace and the EnvoyFilter resource.
Apply the EnvoyFilter to modify HTTP headers.

import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

// Define the namespace where the EnvoyFilter will be applied
const namespace = new k8s.core.v1.Namespace("istio-system", {
    metadata: {
        name: "istio-system",
    },
});

// Define the EnvoyFilter resource
const envoyFilter = new k8s.apiextensions.CustomResource("envoyFilter", {
    apiVersion: "networking.istio.io/v1alpha3",
    kind: "EnvoyFilter",
    metadata: {
        name: "my-envoyfilter",
        namespace: namespace.metadata.name,
    },
    spec: {
        workloadSelector: {
            labels: {
                app: "my-app",
            },
        },
        configPatches: [
            {
                applyTo: "HTTP_FILTER",
                match: {
                    context: "SIDECAR_INBOUND",
                    listener: {
                        filterChain: {
                            filter: {
                                name: "envoy.http_connection_manager",
                                subFilter: {
                                    name: "envoy.router",
                                },
                            },
                        },
                    },
                },
                patch: {
                    operation: "INSERT_BEFORE",
                    value: {
                        name: "envoy.filters.http.lua",
                        typed_config: {
                            "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
                            inlineCode: `
                                function envoy_on_request(request_handle)
                                    request_handle:headers():add("x-custom-header", "my-value")
                                end
                            `,
                        },
                    },
                },
            },
        ],
    },
});

// Export the namespace and EnvoyFilter names
export const namespaceName = namespace.metadata.name;
export const envoyFilterName = envoyFilter.metadata.name;

Summary:

In this guide, we configured a Kubernetes EnvoyFilter for Istio workloads using Pulumi. The EnvoyFilter was defined to add a custom HTTP header to incoming requests. This configuration was managed using Pulumi’s Kubernetes provider and written in TypeScript.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.