Skip to content

Instantly share code, notes, and snippets.

@escoffier
Last active November 13, 2022 15:49
Show Gist options
  • Save escoffier/ef88c7081a76f8becbf43dde314921f1 to your computer and use it in GitHub Desktop.
Save escoffier/ef88c7081a76f8becbf43dde314921f1 to your computer and use it in GitHub Desktop.

requirements:

install bookinfo application in namespace mesh install httpbin application

kubectl apply -n mesh -f samples/httpbin/httpbin.yaml
kubectl apply -n mesh -f samples/bookinfo/platform/kube/bookinfo.yaml

create headless service for httpbin

apiVersion: v1
kind: Service
metadata:
  name: httpbin-headless
  namespace: mesh
spec:
  selector:
    app: httpbin
  ports:
  - port: 8000
    targetPort: 80
  clusterIP: None

test cases:

case 1: duplicate hosts

virtualservice

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: duplicate-hosts
spec:
  hosts:
  - reviews.mesh.svc.cluster.local
  - reviews.mesh
  gateways:
  - mesh
  http:
  - timeout: 5s
    route:
    - destination:
        host: reviews.mesh

generated envoy virtualhost configuration

merged

{
    "name": "reviews.mesh:9080",
    "domains": [
        "reviews.mesh",
        "reviews.mesh.svc.cluster.local",
        "reviews",
        "reviews.mesh.svc",
        "10.99.72.70"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/"
            },
            "route": {
                "cluster": "outbound|9080||reviews.mesh",
                "timeout": "5s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxGrpcTimeout": "5s"
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/duplicate-hosts"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
}

before merged

{
    "name": "reviews.mesh.svc.cluster.local:9080",
    "domains": [
        "reviews.mesh.svc.cluster.local",
        "reviews",
        "reviews.mesh.svc",
        "10.99.207.88"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/"
            },
            "route": {
                "cluster": "outbound|9080||reviews.mesh",
                "timeout": "5s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxGrpcTimeout": "5s"
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/duplicate-hosts"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
},
{
    "name": "reviews.mesh:9080",
    "domains": [
        "reviews.mesh"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/"
            },
            "route": {
                "cluster": "outbound|9080||reviews.mesh",
                "timeout": "5s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxGrpcTimeout": "5s"
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/duplicate-hosts"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
}

case 2: headless service

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: with-service
spec:
  hosts:
  - httpbin-headless.mesh.svc.cluster.local
  - example.com
  gateways:
  - mesh
  http:
  - timeout: 5s
    route:
    - destination:
        host: test.org
        port:
          number: 64

generated envoy virtualhost configuration

merged

{
    "name": "example.com:8000",
    "domains": [
        "example.com",
        "httpbin-headless.mesh.svc.cluster.local",
        "httpbin-headless",
        "httpbin-headless.mesh.svc",
        "httpbin-headless.mesh",
        "*.httpbin-headless.mesh.svc.cluster.local",
        "*.httpbin-headless",
        "*.httpbin-headless.mesh.svc",
        "*.httpbin-headless.mesh"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/"
            },
            "route": {
                "cluster": "outbound|64||test.org",
                "timeout": "5s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxGrpcTimeout": "5s"
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "test.org:64/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
},

before merged

{
    "name": "example.com:8000",
    "domains": [
        "example.com"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/"
            },
            "route": {
                "cluster": "outbound|64||test.org",
                "timeout": "5s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxGrpcTimeout": "5s"
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "test.org:64/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
},
{
    "name": "httpbin-headless.mesh.svc.cluster.local:8000",
    "domains": [
        "httpbin-headless.mesh.svc.cluster.local",
        "httpbin-headless",
        "httpbin-headless.mesh.svc",
        "httpbin-headless.mesh",
        "*.httpbin-headless.mesh.svc.cluster.local",
        "*.httpbin-headless",
        "*.httpbin-headless.mesh.svc",
        "*.httpbin-headless.mesh"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/"
            },
            "route": {
                "cluster": "outbound|64||test.org",
                "timeout": "5s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxGrpcTimeout": "5s"
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "test.org:64/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
},

case 3: subset

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews-destination
  namespace: mesh
spec:
  host: reviews.mesh.svc.cluster.local
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: with-subset
spec:
  hosts:
  - reviews.mesh.svc.cluster.local
  - reviews.v1
  - reviews.v2
  gateways:
  - mesh
  http:
  - match:
    - headers:
        authority:
          exact: reviews.v1
    route:
    - destination:
        host: reviews
        subset: v1
  - match:
    - headers:
        authority:
          exact: reviews.v2
    route:
    - destination:
        host: reviews
        subset: v2

generated envoy virtualhost configuration

merged:

{
    "name": "reviews.v1:9080",
    "domains": [
        "reviews.v1",
        "reviews.v2",
        "reviews.mesh.svc.cluster.local",
        "reviews",
        "reviews.mesh.svc",
        "reviews.mesh",
        "10.99.72.70"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v1"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v1|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-subset"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        },
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v2"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v2|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-subset"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
}

before merged

{
    "name": "reviews.mesh.svc.cluster.local:9080",
    "domains": [
        "reviews.mesh.svc.cluster.local",
        "reviews",
        "reviews.mesh.svc",
        "reviews.mesh",
        "10.99.207.88"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v1"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v1|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        },
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v2"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v2|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
},
{
    "name": "reviews.v1:9080",
    "domains": [
        "reviews.v1"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v1"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v1|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        },
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v2"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v2|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
},
{
    "name": "reviews.v2:9080",
    "domains": [
        "reviews.v2"
    ],
    "routes": [
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v1"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v1|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        },
        {
            "match": {
                "prefix": "/",
                "caseSensitive": true,
                "headers": [
                    {
                        "name": "authority",
                        "stringMatch": {
                            "exact": "reviews.v2"
                        }
                    }
                ]
            },
            "route": {
                "cluster": "outbound|9080|v2|reviews.mesh.svc.cluster.local",
                "timeout": "0s",
                "retryPolicy": {
                    "retryOn": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                    "numRetries": 2,
                    "retryHostPredicate": [
                        {
                            "name": "envoy.retry_host_predicates.previous_hosts",
                            "typedConfig": {
                                "@type": "type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
                            }
                        }
                    ],
                    "hostSelectionRetryMaxAttempts": "5",
                    "retriableStatusCodes": [
                        503
                    ]
                },
                "maxStreamDuration": {
                    "maxStreamDuration": "0s",
                    "grpcTimeoutHeaderMax": "0s"
                }
            },
            "metadata": {
                "filterMetadata": {
                    "istio": {
                        "config": "/apis/networking.istio.io/v1alpha3/namespaces/mesh/virtual-service/with-service"
                    }
                }
            },
            "decorator": {
                "operation": "reviews.mesh.svc.cluster.local:9080/*"
            }
        }
    ],
    "includeRequestAttemptCount": true
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment