在Istio Sidecar中配置过滤器以允许重复请求头

你的问题出在EnvoyFilter的配置层级错误：http_protocol_options是HttpConnectionManager（网络过滤器）的直接配置项，而你当前的配置试图将其合并到HTTP_FILTER层级，导致配置没有被正确应用到Envoy的核心连接管理模块中。

修正后的EnvoyFilter配置（仅允许重复Authorization头） #

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: auth-header-filter
spec:
  workloadSelector:
    labels:
      app: received_pod_name
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          http_protocol_options:
            allow_duplicate_authorization_header: true

如果需要允许其他重复请求头 #

若要放行Authorization之外的重复头（比如自定义的X-Custom-Header），需改用allow_duplicate_headers列表配置：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: allow-duplicate-headers
spec:
  workloadSelector:
    labels:
      app: received_pod_name
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          http_protocol_options:
            allow_duplicate_headers:
            - "Authorization"
            - "X-Custom-Header"

验证配置生效方法 #

1. 应用EnvoyFilter后，重启目标Pod（或等待Istio自动推送配置）
2. 发送带重复头的请求测试：

   curl -H "Authorization: token1" -H "Authorization: token2" http://<目标Pod服务地址>
   

3. 检查目标Pod的Envoy配置，确认参数已生效：

   istioctl pc <目标Pod名称> all -o yaml | grep -A5 http_protocol_options
   

内容的提问来源于stack exchange，提问作者Peter Penzov