Remove Server : istio-envoy header in Istio 1.8.2 - istio

Question

How can I remove the server header generated by Istio ?
In Istio 1.5.6 I had an Istio EnvoyFilter, but that doesn't seem to work anymore in Istio 1.8.2.
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: dgp-headerstrip-server
namespace: istio-system
spec:
configPatches:
- applyTo: NETWORK_FILTER
match:
listener:
filterChain:
filter:
name: "envoy.http_connection_manager"
patch:
operation: MERGE
value:
config:
server_header_transformation: PASS_THROUGH

Answer 1

Solved : use typed_config (https://github.com/istio/istio/issues/13861)
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: dgp-headerstrip-server
namespace: istio-system
spec:
configPatches:
- applyTo: NETWORK_FILTER
match:
listener:
filterChain:
filter:
name: envoy.filters.network.http_connection_manager
patch:
operation: MERGE
value:
typed_config:
'#type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
server_header_transformation: PASS_THROUGH

Answer 2

To avoid the deprecated warning, tested with Istio 1.9
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: remove-server-header
namespace: istio-system
spec:
configPatches:
- applyTo: NETWORK_FILTER
match:
listener:
filterChain:
filter:
name: envoy.filters.network.http_connection_manager
patch:
operation: MERGE
value:
typed_config:
'#type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
server_header_transformation: PASS_THROUGH

Answer 3

You can also set, add, remove a header directly from Istio, with a VirtualService object?
Example
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: reviews-route
spec:
hosts:
- reviews.prod.svc.cluster.local
http:
- headers:
request:
set:
test: "true"
route:
- destination:
host: reviews.prod.svc.cluster.local
subset: v2
weight: 25
- destination:
host: reviews.prod.svc.cluster.local
subset: v1
headers:
response: # this is from the response, but you can put it in the request as well.
remove:
- foo
weight: 75
Header parameters.

Answer 4

I'm using Istio-1.9.0 version, to remove the response headers, you will have to apply envoy filter configuration onto the Kubernetes cluster, then you must be add it in the Virtual service otherwise it wont work.
Along with remove we can also add set, add for modifications and adding the headers
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
namespace: istio-system
name: remove-server-header
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: NETWORK_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: envoy.filters.network.http_connection_manager
patch:
operation: MERGE
value:
typed_config:
'#type': type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
server_header_transformation: PASS_THROUGH
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: x-api-vs
spec:
hosts:
- {{ .Values.domain }}
- {{ .Values.serviceName }}
gateways:
- istio-system/istio-ingressgateway
http:
- match:
- port: 80
route:
- destination:
host: {{ .Values.serviceName }}
subset: x-v1-app
port:
number: {{ .Values.service.servicePort }}
headers:
response:
remove:
- Server
---
kind: DestinationRule
apiVersion: networking.istio.io/v1alpha3
metadata:
name: x-api-dr-rules
spec:
host: {{ .Values.serviceName }}
subsets:
- labels:
version: v1
name: x-v1-app
Istio documentation https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers-HeaderOperations