I'm trying to define a Virtual Service in Istio (1.3.3) which has multiple matches but within the matches, there should be OR functionality.
For example : (pseudo code)
match
header-key = value1
OR header-key = value2
OR header-key = value3
OR ....
OR header-key = value100
AND
match
uri-prefix = prefix1
OR uri-prefix = prefix2
OR uri-prefix = prefix3
OR uri-prefix = ...
OR uri-prefix = prefix100
So for every AND block there should be at least one matching OR condition.
I 've tried with a match but then if 1 of all the conditions are met, then it is valid, but what I want is to match one of the API keys and match one of the URI prefixes.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: test
namespace: demo
spec:
hosts:
- test1
gateways:
- test-gateway
http:
- match:
- headers:
apikey:
exact: 111
- headers:
apikey:
exact: 222
- headers:
apikey:
exact: 333
- uri:
prefix: /path1/
- uri:
prefix: /path2/
rewrite:
uri: /newpath/v1/
authority: test2
route:
- destination:
host: test2
- fault:
abort:
httpStatus: 444
percent: 100
route:
- destination:
host: test2
Related
I am working on rate limit using the istio. I want to apply different rate limit based on the regex. The url which has /api/iam/.* should have rate limit of 2 req/minute and default rate limit on other paths should be 100 req/s. I am trying to use
rate_limits:
- actions:
- header_value_match:
descriptor_value: two_legged_path
headers:
- name: ":path"
string_match:
safe_regex:
google_re2: {}
regex: "api/iam/.*"
we used string_match with safe_regex but it is not working. It always applies the default behaviour which is 100 req/s. Could you please help I have followed numerious examples and nothing seemed to work.
The full configuration
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-local-ratelimit-svc
namespace: istio-system
spec:
workloadSelector:
labels:
app: iam-authn-service
env: az-dev
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_INBOUND
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.local_ratelimit
typed_config:
"#type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
- applyTo: HTTP_ROUTE
match:
context: SIDECAR_INBOUND
routeConfiguration:
vhost:
name: "inbound|http|8080"
route:
action: ANY
patch:
operation: MERGE
value:
route:
rate_limits:
- actions:
- header_value_match:
descriptor_value: two_legged_path
headers:
- name: ":path"
string_match:
safe_regex:
google_re2: {}
regex: "api/iam/.*"
typed_per_filter_config:
envoy.filters.http.local_ratelimit:
"#type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
descriptors:
- entries:
- key: header_match
value: two_legged_path
token_bucket:
max_tokens: 2
tokens_per_fill: 2
fill_interval: 60s
token_bucket:
max_tokens: 100
tokens_per_fill: 100
fill_interval: 1s
filter_enabled:
runtime_key: local_rate_limit_enabled
default_value:
numerator: 100
denominator: HUNDRED
filter_enforced:
runtime_key: local_rate_limit_enforced
default_value:
numerator: 100
denominator: HUNDRED
response_headers_to_add:
- append: false
header:
key: x-local-rate-limit
value: 'true'
The istio doesn't use the latest envoy, the valid doc: https://www.envoyproxy.io/docs/envoy/v1.17.1/api-v3/type/matcher/v3/regex.proto#envoy-v3-api-msg-type-matcher-v3-regexmatcher-googlere2
use safe_regex_match instead of string_match
I'd like to re-direct queries with Istio based on the query parameter ?key=value. That works with the following VirtualService (with re-directing replaced by returning a different string):
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: httpbin
spec:
hosts:
- "httpbin.example.com"
gateways:
- httpbin-gateway
http:
- match:
- queryParams:
key:
exact: "value"
directResponse:
status: 301
body:
string: "redirected"
- directResponse:
status: 200
body:
string: "standard"
The issue is that sometimes I get the query ?key=foo&key=value for which I would also like to match and re-direct, but that doesn't work, the first "key" matches, the value param "foo" doesn't, so the whole match fails. Is there a way to match one of multiple keys with different values? "value" is fixed, "foo" can also be something else, except it is not "value".
Hi i have string like below,
apiVersion: v1
clusters:
- cluster: <------------------------ this is one cluster
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ
server: https://api.someaddress
name: https://api.anotheraddress
- second_cluster: <------------------------ this is second cluster
certificate-authority-data: LS0tLS1
server: https://api.someaddress
name: https://api.
contexts:
- context: <------------------------ this is one context
cluster: https://api.another1address
namespace: name1
user: user1
name: somename
- another_context: <------------------------ this is second context
cluster: https://api.anotheraddress
namespace: esm2
user: admin
name: somename1
current-context: some-context
kind: somekind
preferences: {}
users:
- name: user-admin
user:
token: eyJhb
how can i check if the there is more than one cluster under clusters and more than one context under contexts using regex.
i have tried something like below
var matchServer = new RegExp(/- cluster:\n[A-Za-z0-9\- :]*\n[ ]+server: ([A-Za-z:.//]*)/, "gi").exec(s);
const namespace = s.match(/contexts:\n- context:\n[A-Za-z0-9\- :.//]*\n[ ]+namespace: ([A-Za-z0-9]*)/i);
but this gives server and namespace also only one occurrence is returned.
i want to get the number of matched string "cluster" under clusters and context under contexts.
could someone help me with this. i am new to programming. thanks.
what i have tried?
i have tried regex to match "context" "another_context" under contexts. but it matches only "context"
contexts:\n-.*context:+
could someone help me understand why it doesnt match the another_context string
updated question:
with the regex
const matchServer = result.match(/- [a-z_]cluster:[A-Za-z0-9- :\n][ ]+server: ([A-Za-z0-9:.//]*)/gi);
this returns null for below string although there is server under cluster.
apiVersion: v1
clusters:
- cluster:
certificate-authority-data:
LS0tLS1CRUd
server: https://api.sandbox1.lab.fi.eu.ericsson.se
name: https://api.sandbox1.lab.fi.eu.ericsson.se
contexts:
- context:
cluster: https://api.sandbox1.lab.fi.eu.ericsson.se
namespace: esm1
user: esm-esm1-ci-namespace-admin
name: esm-context
current-context: esm-context
kind: Config
preferences: {}
users:
- name: esm-esm1-ci-namespace-admin
user:
token:
eyJhbGc
why doesnt the above regex work for this string. could someone help me with this. thanks.
<html>
<head>
<script>
var s = `apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ
server: https://api.someaddress1
name: https://api.anotheraddress
- second_cluster:
certificate-authority-data: LS0tLS1
server: https://api.someaddress2
name: https://api.
contexts:
- context:
cluster: https://api.another1address
namespace: name1
user: user1
name: somename
- another_context:
cluster: https://api.anotheraddress
namespace: esm2
user: admin
name: somename1
current-context: some-context
kind: somekind
preferences: {}
users:
- name: user-admin
user:
token: eyJhb`;
var matchServer = s.match(/- [a-z_]*cluster:/gi)
var matchNamespace = s.match(/- [a-z_]*context:/gi)
document.write(matchServer.length + ' servers <br/>')
for(i=0;i<matchServer.length;i++)
document.write(matchServer[i] + '<br/>')
document.write(matchNamespace.length + ' namespaces <br/>')
for(i=0;i<matchNamespace.length;i++)
document.write(matchNamespace[i] + '<br/>')
</script>
</head>
<body>
</body>
</html>
js fiddle
For completeness, here's a solution with a YAML parser - provided that it actually is YAML, because the last part (users) isn't valid YAML. Also some indentation wasn't right. I assume it has been modified to not leak sensitive information.
Update: Oh, I see this is a kubernetes config file. So it really is YAML then.
https://jsfiddle.net/1Lpsk740/ (with document.write instead of console.log)
<!DOCTYPE html>
<html>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-yaml/4.1.0/js-yaml.js"></script>
<script>
var input = `apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ
server: https://api.someaddress1
name: https://api.anotheraddress
- second_cluster:
certificate-authority-data: LS0tLS1
server: https://api.someaddress2
name: https://api.
contexts:
- context:
cluster: https://api.another1address
namespace: name1
user: user1
name: somename
- another_context:
cluster: https://api.anotheraddress
namespace: esm2
user: admin
name: somename1`;
const doc = jsyaml.load(input);
console.log('servers: ' + doc.clusters.length);
doc.clusters.forEach(e => console.log('- ' + Object.keys(e)[0]));
console.log('namespaces: ' + doc.contexts.length);
doc.contexts.forEach(e => console.log('- ' + Object.keys(e)[0]));
</script>
</html>
Output:
servers: 2
- cluster
- second_cluster
namespaces: 2
- context
- another_context
How could I write rule for my VirtuelService such that traffic with url "/v1/myservice" and header "x-client-id: test" should route to "my-service-v2-dev", otherwise traffic with url "/v1/myservice" and with any header should route to "my-service-dev"
Below is my code which is not working as expected and all traffic is going to "my-service-v2-dev".
Can anybody help me and let me know what mistake I am doing here?
Thanks In advance.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: my-public-dev
namespace: my-dev
spec:
gateways:
- my-public-dev
hosts:
- my-public-dev.com.digital
http:
- match:
- headers:
x-client-id:
exact: test
- uri:
prefix: /v1/myservice/
name: myservice-v2-route
route:
- destination:
host: my-service-v2-dev
port:
number: 8080
- match:
- uri:
prefix: /v1/myservice/
name: myservice-v1-route
route:
- destination:
host: my-service-dev
port:
number: 8888
The match in the first route means you have a list of two conditions, combined with logical OR.. If you want to use AND, you have to move that to one condition, which can include a header and a uri condition and is combined with AND.
See
https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPMatchRequest
https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute
(in response to comments)
For more complex matching, you can split the conditions with logical operations, e.g. first match url1 AND header, second match, url2 AND header, third url1, fourth url2, fifth catch all for the rest.
Or match the urls with a Regex, so multiple URLs could also be represented by that Regex.
As per https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/#HTTPMatchRequest ,
HttpMatchRequest specifies a set of criterion to be met in order for the rule to be applied to the HTTP request. For example, the following restricts the rule to match only requests where the URL path starts with /ratings/v2/ and the request contains a custom end-user header with value jason.
i take that to mean the matching should be of type AND .
Below is an istio virtual service definition. As per the above definition, I'd assume that this virtual service only permits requests of the form POST /status/...
However, It seems that the logic is actually OR i.e. either POST requests or (for instance, GET /status/xxx) requests go through . Can someone explain or correct my config.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: "httpbin-virtual-service"
spec:
hosts:
- "*"
gateways:
- my-istio-gateway
http:
- match:
- method:
exact: POST
- uri:
prefix: /status
route:
- destination:
host: "httpbin"
port:
number: 80 # application port
Output
$ siege -c1 -d1 --content-type "application/json" '127.0.0.1:31380/delay/2 POST {"ids": ["1","2","3"]}' ==> not a request to /status/.. , why does this match
HTTP/1.1 200 2.00 secs: 1072 bytes ==> POST http://127.0.0.1:31380/delay/2
HTTP/1.1 200 2.01 secs: 1072 bytes ==> POST http://127.0.0.1:31380/delay/2
..
$ siege -c1 -d1 127.0.0.1:31380/status/200 ====================> not a POST request , why does this match
HTTP/1.1 200 0.00 secs: 0 bytes ==> GET /status/200
HTTP/1.1 200 0.00 secs: 0 bytes ==> GET /status/200
..
Solved, I had a "-" before uri
The correct config should be
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: "httpbin-virtual-service"
spec:
hosts:
- "*"
gateways:
- my-istio-gateway
http:
- match:
- method:
exact: POST
uri:
prefix: /status
route:
- destination:
host: "httpbin"
port:
number: 80 # application port