For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Apply the EnvoyFilter API to waypoint proxies in your ambient mesh with Solo Enterprise for Istio.

The EnvoyFilter resource provides direct access to modify Envoy proxy configuration. You can add, remove, or modify HTTP filters, network filters, cluster settings, and route behavior. EnvoyFilters are typically used for traffic management scenarios not yet expressed through higher-level Istio APIs, such as local rate limiting and custom header processing.

In upstream Istio, EnvoyFilter is supported for sidecar proxies and ingress gateways, but not for waypoint proxies in ambient mode. Solo Enterprise for Istio extends this to waypoints so that you can apply Envoy-level customizations to Layer 7 traffic directly in your ambient mesh.

How it works

When a workload in the ambient mesh is enrolled in a waypoint, all Layer 7 traffic passes through that waypoint. The Solo distribution of Istio processes EnvoyFilter resources that target the waypoint, then applies the configuration patches to the waypoint’s Envoy listeners and routes during xDS configuration generation.

The key differences when targeting a waypoint versus a sidecar proxy are:

• Context: Use GATEWAY as the patch context. The SIDECAR_INBOUND and SIDECAR_OUTBOUND contexts do not apply to waypoints.
• Target: Use the targetRefs field to reference the waypoint’s Gateway resource. The label-based workloadSelector does not apply to waypoints.

Before you begin

Deploy a waypoint proxy in the namespace where you want to apply EnvoyFilter configurations. EnvoyFilter patches take effect only on traffic routed through a waypoint.See Configure waypoints.

Apply an EnvoyFilter to a waypoint

Create an EnvoyFilter resource that targets a waypoint’s Gateway resource. The following example shows the structure for inserting an HTTP filter before the default filter chain.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: <filter-name>
  namespace: <namespace>
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: waypoint
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.<filter-name>
        typed_config:
          "@type": <filter-type-url>
          # filter-specific settings

Examples

The following guide provides a complete example of using EnvoyFilter with a waypoint proxy:

• Rate limiting: Use the Envoy local rate limit filter to cap inbound request rates at a waypoint proxy.