I'd like to re-direct queries with Istio based on the query parameter ?key=value. That works with the following VirtualService (with re-directing replaced by returning a different string):
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin
spec:
hosts:
- "httpbin.example.com"
gateways:
- httpbin-gateway
http:
- match:
- queryParams:
key:
exact: "value"
directResponse:
status: 301
body:
string: "redirected"
- directResponse:
status: 200
body:
string: "standard"
The issue is that sometimes I get the query ?key=foo&key=value for which I would also like to match and re-direct, but that doesn't work, the first "key" matches, the value param "foo" doesn't, so the whole match fails. Is there a way to match one of multiple keys with different values? "value" is fixed, "foo" can also be something else, except it is not "value".
Related
I am working on rate limit using the istio. I want to apply different rate limit based on the regex. The url which has /api/iam/.* should have rate limit of 2 req/minute and default rate limit on other paths should be 100 req/s. I am trying to use
rate_limits:
- actions:
- header_value_match:
descriptor_value: two_legged_path
headers:
- name: ":path"
string_match:
safe_regex:
google_re2: {}
regex: "api/iam/.*"
we used string_match with safe_regex but it is not working. It always applies the default behaviour which is 100 req/s. Could you please help I have followed numerious examples and nothing seemed to work.
The full configuration
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-local-ratelimit-svc
namespace: istio-system
spec:
workloadSelector:
labels:
app: iam-authn-service
env: az-dev
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_INBOUND
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.local_ratelimit
typed_config:
"#type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
- applyTo: HTTP_ROUTE
match:
context: SIDECAR_INBOUND
routeConfiguration:
vhost:
name: "inbound|http|8080"
route:
action: ANY
patch:
operation: MERGE
value:
route:
rate_limits:
- actions:
- header_value_match:
descriptor_value: two_legged_path
headers:
- name: ":path"
string_match:
safe_regex:
google_re2: {}
regex: "api/iam/.*"
typed_per_filter_config:
envoy.filters.http.local_ratelimit:
"#type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
descriptors:
- entries:
- key: header_match
value: two_legged_path
token_bucket:
max_tokens: 2
tokens_per_fill: 2
fill_interval: 60s
token_bucket:
max_tokens: 100
tokens_per_fill: 100
fill_interval: 1s
filter_enabled:
runtime_key: local_rate_limit_enabled
default_value:
numerator: 100
denominator: HUNDRED
filter_enforced:
runtime_key: local_rate_limit_enforced
default_value:
numerator: 100
denominator: HUNDRED
response_headers_to_add:
- append: false
header:
key: x-local-rate-limit
value: 'true'
The istio doesn't use the latest envoy, the valid doc: https://www.envoyproxy.io/docs/envoy/v1.17.1/api-v3/type/matcher/v3/regex.proto#envoy-v3-api-msg-type-matcher-v3-regexmatcher-googlere2
use safe_regex_match instead of string_match
How could I write rule for my VirtuelService such that traffic with url "/v1/myservice" and header "x-client-id: test" should route to "my-service-v2-dev", otherwise traffic with url "/v1/myservice" and with any header should route to "my-service-dev"
Below is my code which is not working as expected and all traffic is going to "my-service-v2-dev".
Can anybody help me and let me know what mistake I am doing here?
Thanks In advance.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: my-public-dev
namespace: my-dev
spec:
gateways:
- my-public-dev
hosts:
- my-public-dev.com.digital
http:
- match:
- headers:
x-client-id:
exact: test
- uri:
prefix: /v1/myservice/
name: myservice-v2-route
route:
- destination:
host: my-service-v2-dev
port:
number: 8080
- match:
- uri:
prefix: /v1/myservice/
name: myservice-v1-route
route:
- destination:
host: my-service-dev
port:
number: 8888
The match in the first route means you have a list of two conditions, combined with logical OR.. If you want to use AND, you have to move that to one condition, which can include a header and a uri condition and is combined with AND.
See
https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute
(in response to comments)
For more complex matching, you can split the conditions with logical operations, e.g. first match url1 AND header, second match, url2 AND header, third url1, fourth url2, fifth catch all for the rest.
Or match the urls with a Regex, so multiple URLs could also be represented by that Regex.
I'm trying to define a Virtual Service in Istio (1.3.3) which has multiple matches but within the matches, there should be OR functionality.
For example : (pseudo code)
match
header-key = value1
OR header-key = value2
OR header-key = value3
OR ....
OR header-key = value100
AND
match
uri-prefix = prefix1
OR uri-prefix = prefix2
OR uri-prefix = prefix3
OR uri-prefix = ...
OR uri-prefix = prefix100
So for every AND block there should be at least one matching OR condition.
I 've tried with a match but then if 1 of all the conditions are met, then it is valid, but what I want is to match one of the API keys and match one of the URI prefixes.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: test
namespace: demo
spec:
hosts:
- test1
gateways:
- test-gateway
http:
- match:
- headers:
apikey:
exact: 111
- headers:
apikey:
exact: 222
- headers:
apikey:
exact: 333
- uri:
prefix: /path1/
- uri:
prefix: /path2/
rewrite:
uri: /newpath/v1/
authority: test2
route:
- destination:
host: test2
- fault:
abort:
httpStatus: 444
percent: 100
route:
- destination:
host: test2
How can I configure nginx.ingress.kubernetes.io/rewrite-target and spec.rules.http.paths.path to satisfy the following URI patterns?
/aa/bb-aa/coolapp
/aa/bb-aa/coolapp/cc
Legend:
a = Any letter between a-z. Lowercase. Exactly 2 letters - no more,
no less.
b = Any letter between a-z. Lowercase. Exactly 2 letters - no more, no less.
c = any valid URI character. Lowercase. Of variable length - think slug.
Example URI:s that should match the above pattern:
/us/en-us/coolapp
/us/en-us/coolapp/faq
/us/en-us/coolapp/privacy-policy
Attention
Starting in Version 0.22.0, ingress definitions using the annotation nginx.ingress.kubernetes.io/rewrite-target are not backwards compatible with previous versions. In Version 0.22.0 and beyond, any substrings within the request URI that need to be passed to the rewritten path must explicitly be defined in a capture group.
Note
Captured groups are saved in numbered placeholders, chronologically, in the form $1, $2 ... $n. These placeholders can be used as parameters in the rewrite-target annotation.
References:
https://kubernetes.github.io/ingress-nginx/examples/rewrite/
https://github.com/kubernetes/ingress-nginx/pull/3174
The nginx.ingress.kubernetes.io/rewrite-target annotation is used to indicate the target URI where the traffic must be redirected. As per how I understand your question, you only want to match the URI patterns that you specified without redirecting the traffic. In order to achieve this, you can set the nginx.ingress.kubernetes.io/use-regex annotation to true, thus enabling regular expressions in the spec.rules.http.paths.path field.
Let's now take a look at the regex that you will need to match your URI patterns.
First of all, the regex engine used by ingress-nginx doesn't support backreferences, therefore a regex like this one will not work. This is not a problem as you can match the /aa-bb/aa part without forcing the two aas to be equal since you will —presumably— still have to check the correctness of the URI later on in your service (e.g /us/en-us may be accepted whereas /ab/cd-ab may not).
You can use this regex to match the specified URI patterns:
/[a-z]{2}/[a-z]{2}-[a-z]{2}/coolapp(/.*)?
If you want to only match URL slugs in the cc part of the pattern you specified, you can use this regex instead:
/[a-z]{2}/[a-z]{2}-[a-z]{2}/coolapp(/[a-z0-9]+([a-z0-9]+)*)?
Lastly, as the nginx.ingress.kubernetes.io/use-regex enforces case insensitive regex, using [A-Z] instead of [a-z] would lead to the same result.
Follows an ingress example definition using the use-regex annotation:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test-regex
annotations:
nginx.ingress.kubernetes.io/use-regex: "true"
spec:
rules:
- host: test.com
http:
paths:
- path: /[a-z]{2}/[a-z]{2}-[a-z]{2}/coolapp(/.*)?
backend:
serviceName: test
servicePort: 80
You can find more information about Ingress Path Matching in the official user guide.
Came up with the following configuration - it is working for all of my test routes / requirements so far.
The regex is almost the same as the one posted by #Gilgames.
I based mine on the official docs rewrite example: https://kubernetes.github.io/ingress-nginx/examples/rewrite/#rewrite-target
Apart from that I took a quick course at https://www.regular-expressions.info/ 😁
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: test-ing
namespace: some-ns
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/rewrite-target: /$1/$2-$3/$5
certmanager.k8s.io/cluster-issuer: letsencrypt-prod
nginx.ingress.kubernetes.io/affinity: "cookie"
nginx.ingress.kubernetes.io/session-cookie-name: "INGRESSCOOKIE"
nginx.ingress.kubernetes.io/session-cookie-path: /
nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
nginx.ingress.kubernetes.io/configuration-snippet: |
if ($host = 'example.com')
{
rewrite ^ https://www.example.com$request_uri permanent;
}
spec:
tls:
- hosts:
- www.example.com
- example.com
secretName: tls-secret-test
rules:
- host: www.example.com
http:
paths:
- path: /([a-z]{2})/([a-z]{2})-([a-z]{2})/coolapp(/|$)(.*)
backend:
serviceName: coolapp-svc
servicePort: 80
- host: example.com
http:
paths:
- path: /([a-z]{2})/([a-z]{2})-([a-z]{2})/coolapp(/|$)(.*)
backend:
serviceName: coolapp-svc
servicePort: 80
How can I use a part of matched URI in destination rule in istio?
Trying to achieve something like this:
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
spec:
http:
- match:
- uri:
regex: "^/foo/(.+)/?$"
route:
- destination:
host: bar-$1
port:
number: 80
As far as I know this is not possible at all.
Cant provide you any confirmation link on this.
The similar question was here in the past:
can istio support route to different service by dynamic part of uri path