Service Mesh (ASM) allows you to create an Envoy filter by using an Envoy filter template. The same Envoy filter template can be used to create multiple Envoy filters, and these Envoy filters can be applied to different workloads and namespaces. This makes configurations reusable and improves management efficiency. When the version of an ASM instance is updated, the Envoy filter templates can automatically create or change the corresponding Envoy filters. This ensures a smooth version update and reduces complex manual operations and potential errors.
Prerequisites
A cluster is added to an ASM instance of v1.12.4.0 or later. For more information about how to add a cluster to an ASM instance, see Add a cluster to an ASM instance. For more information about how to update an ASM instance, see Update an ASM instance.
Relationships between Envoy filter templates and Envoy filters
An Envoy filter is an instance of an Envoy filter template. An Envoy filter template acts as a blueprint or definition that specifies the configurations and parameters required to create an Envoy filter.
Envoy filter template: a predefined configuration structure that contains the templates for all the rules and parameters required to create Envoy filters. A template defines how traffic passing through the Envoy proxy is processed, but it does not apply directly to traffic.
Envoy filter: an actual configuration entity that is created by using a template. An Envoy filter is applied to an Envoy proxy in an ASM instance to filter and process the traffic passing through the proxy. An Envoy filter is an instance of a template, which applies the rules and parameters in the template to actual traffic.
Self-managed Envoy filters may be incompatible with ASM instances after the instances are updated or maintained. For ASM instances of v1.12.4.0 and later, you can use Envoy filter templates to create Envoy filters. After you update an ASM instance, the system automatically creates new Envoy filters or modifies the existing Envoy filters by using Envoy filter templates to ensure that the Envoy filters are compatible with the ASM instance. This prevents version compatibility issues of Envoy filters and makes Envoy filters easier to use.
After you create an Envoy filter template, you must bind the Envoy filter template to a workload or namespace. Then, ASM automatically creates an Envoy filter by using the template. An Envoy filter template can be bound to multiple workloads and namespaces. This way, you can create multiple Envoy filters by using the template.
Step 1: Create an Envoy filter template
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose . On the page that appears, click Create EnvoyFilter Template.
In the Basic Information section of the Create page, enter a name for the Envoy filter template.
In the Multi-version adapted EnvoyFilter templates section, click Add an EnvoyFilter template for specific adapted istio version, select an Istio version from the Adapted istio version drop-down list, configure the parameters, and then click Create.
NoteIf the version of your ASM instance is 1.18.0.146 or later, No Minimum Version Limit and No Maximum Version Limit are selected in the Adapted istio version section by default. To customize the Isito version range to which the Envoy filter template applies, clear No Minimum Version Limit or No Maximum Version Limit and enter a version.
For more information about the configuration examples and fields of Envoy filters, see Envoy Filter.
After you create an Envoy filter template, you can view the Envoy filter template on the EnvoyFilter Template page.
Step 2: Bind the Envoy filter template to a workload or namespace
After you create an Envoy filter template, you must bind the Envoy filter template to workloads or namespaces. This way, the Envoy filters created based on this template take effects only on the specified workloads or namespaces. After you bind the Envoy filter template to workloads or namespaces, ASM automatically creates Envoy filters by using the template. Perform the following operations based on the version of your ASM instance:
For an ASM instance of a version earlier than 1.18.0.146
Bind an Envoy filter template to a workload
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and click Bind EnvoyFilter to Workloads.
In the Bind EnvoyFilter to Workloads dialog box, set the Namespace and Workload Type parameters, click Bind next to a workload in the Not bound section, and then click OK.
On the details page of the ASM instance, choose in the left-side navigation pane. On the EnvoyFilter page, you can view the Envoy filter that is automatically created.
Bind an Envoy filter template to a namespace
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
On the Edit EnvoyFilter Template page, click the Bind template to workloads tab and click Bind EnvoyFilter to Namespace.
In the Bind EnvoyFilter to Namespace dialog box, click the namespace that you want to configure in the Not bound section and click OK.
NoteIf you bind an Envoy filter template to the istio-system namespace, the Envoy filter template globally takes effect. The Envoy filter template is automatically unbound from other workloads or namespaces to which the template is bound. Therefore, you need to confirm that you want to bind the Envoy filter template to the istio-system namespace.
On the details page of the ASM instance, choose in the left-side navigation pane. On the EnvoyFilter page, you can view the Envoy filter that is automatically created.
For an ASM instance of version 1.18.0.146 or later
Bind an Envoy filter template to a workload
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
In the lower part of the Edit EnvoyFilter Template page, view the Bind template to workloads section.
If the The EnvoyFilter template has adapted this version, but the correspond EnvoyFilters has not been created message is displayed, click Create.
In the Bind template to workloads section, click Bind EnvoyFilter to Workloads. In the Bind EnvoyFilter to Workloads dialog box, set the Namespace and Workload Type parameters, click Bind in the Actions column of the desired workload in the Not bound section, and then click OK.
On the details page of the ASM instance, choose in the left-side navigation pane. On the EnvoyFilter page, you can view the Envoy filter that is automatically created.
Bind an Envoy filter template to a namespace
Log on to the ASM console. In the left-side navigation pane, choose .
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column.
In the lower part of the Edit EnvoyFilter Template page, view the Bind template to workloads section.
If the The EnvoyFilter template has adapted this version, but the correspond EnvoyFilters has not been created message is displayed, click Create.
In the Bind template to workloads section, click Bind EnvoyFilter to Namespace. In the Bind EnvoyFilter to Namespace dialog box, click the name of the namespace to which you want to bind the Envoy filter template in the Not bound section, and then click OK.
NoteIf you bind an Envoy filter template to the istio-system namespace, the Envoy filter template globally takes effect. The Envoy filter template is automatically unbound from other workloads or namespaces to which the template is bound. Therefore, you need to confirm that you want to bind the Envoy filter template to the istio-system namespace.
On the details page of the ASM instance, choose in the left-side navigation pane. On the EnvoyFilter page, you can view the Envoy filter that is automatically created.
Related operations
Modify an Envoy filter
You can modify only Envoy filters that are created by using custom templates. You cannot modify Envoy filters that are created by using preset templates. An Envoy filter template that is displayed as an ASM plug-in on the EnvoyFilter Template page is a preset template.
On the EnvoyFilter Template page, find the Envoy filter template that you want to modify and click Edit template in the Actions column. Modify the template parameters and click Modify template contents. After you modify the Envoy filter template, the Envoy filters that were created by using the template are automatically updated.
Delete an Envoy filter
Delete an Envoy filter by unbinding an Envoy filter template from a workload
On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column. On the Bind template to workloads tab, click Bind EnvoyFilter to Workloads. In the Bind EnvoyFilter to Workloads dialog box, click Unbind next to the workload in the Bound section from which you want to unbind the template and click OK. After you unbind the Envoy filter template from the workload, the Envoy filter that was created for the workload by using the template is automatically deleted.
Delete an Envoy filter by unbinding an Envoy filter template from a namespace
On the EnvoyFilter Template page, find the Envoy filter template that you want to configure and click Edit template in the Actions column. On the Bind template to workloads tab, click Bind EnvoyFilter to Namespace. In the Bind EnvoyFilter to Namespace dialog box, click the namespace from which you want to unbind the template in the Bound section and click OK. After you unbind the Envoy filter template from the namespace, the Envoy filter that was created for the namespace by using the template is automatically deleted.
Delete an Envoy filter by deleting an Envoy filter template
On the EnvoyFilter Template page, find the Envoy filter template that you want to delete and click Delete in the Actions column. In the message that appears, click OK. After you delete the Envoy filter template, the Envoy filters that were created by using the template are automatically deleted.