Why is My Istio EnvoyFilter with TCP Idle Timeout Setting not working?

Question

I have created an EnvoyFilter to apply TCP idle timeout to outbound requests. Here's my filter configuration:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-idle-timeout
spec:
  workloadSelector:
    labels:
      app: mecha-dev
  filters:
    - listenerMatch:
        listenerType: SIDECAR_OUTBOUND
        listenerProtocol: TCP
      filterName: envoy.tcp_proxy
      filterType: NETWORK
      filterConfig:
        idle_timeout: 5s

The istio version is 1.2.5, the envoyproxy version it uses is 1.11.0-dev.

I was successfully able to create the filter but it does not seem to have any effect. I checked istio config dump but I couldn't find my filter there, so I think my filter configuration is wrong.

I followed this document to create the filter.

The document does not give a lot of information. Since Istio version 1.2.5 is an old version, it wouldn't support my earlier filter configuration:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: listener-timeout-tcp
  namespace: istio-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_OUTBOUND
      listener:
        filterChain:
          sni: some.app.com
          filter:
            name: envoy.filters.network.tcp_proxy
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.tcp_proxy
        typed_config:
          '@type': type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
          idle_timeout: 5s

My main requirement is to create a filter that only applies to outbound requests going to some.app.com. I tried converting this filter to make it version 1.2.5 compatible (the first configuration) but I think it's not working.

What's wrong with my EnvoyFilter?

hi. I see you were recommended to run `istioctl dashboard envoy mecha-dev` to check envoy dump [here](https://stackoverflow.com/questions/67295392/why-is-my-tcp-istio-envoyfilter-not-working#comment118988610_67295392). any updates? — Vit, Apr 30 '21 at 13:57
@Vitalii I checked the envoy dump, and I couldn't see it there. Looks like the filter isn't working as I expected. I can't seem to figure out, what is misconfigured. — bakadevops, Apr 30 '21 at 14:52
@Vitalii do you have any idea on how to make this filter work? — bakadevops, May 03 '21 at 05:31

score 1 · Answer 1 · edited May 18 '21 at 12:25

Oke, so after my investigations I have no other choice but to agree with the two already given answers (link1 link2) and unfortunately state the same..

Seems the only option for you to use EnvoyFilter - is to upgrade your Istio to the latest version. Hard decision, I would also think million times before touching something that is working stable, but again.. If you'd like to use the EnvoyFilter than you need a newer version.

Why is My Istio EnvoyFilter with TCP Idle Timeout Setting not working?

1 Answers1