Istio与Envoy环境下重复Transfer-Encoding头引发503错误的排查及解决方案咨询

Let's break down your issues step by step and fix them for your Istio 1.8.2 / Envoy 1.16.1 environment.

Why Your Current Configurations Aren't Working #

1. VirtualService Configurations #

The core problem here is case sensitivity in header matching and incomplete header removal:

• HTTP headers are technically case-insensitive, but Istio's VirtualService header operations in v1.8.2 match header names exactly. Your app returns both transfer-encoding=chunked and Transfer-Encoding=chunked, but your config only removes one variant.
• For your first VirtualService (in my-ns), ensure it's targeting the correct traffic flow (inbound to the service). For the second (gateway-level), double-check that the uri.prefix matches the actual incoming requests to ensure the route rule is applied.

Fix for VirtualServices: Update the remove list to include both case variants:

headers:
  response:
    remove:
      - transfer-encoding
      - Transfer-Encoding

2. EnvoyFilter Configuration #

Your EnvoyFilter has two critical issues:

• Wrong context: You set context: SIDECAR_OUTBOUND, which targets traffic from the sidecar to your app. But duplicate headers come from your app's response into the sidecar—you need SIDECAR_INBOUND instead.
• Missing workload targeting: Without a workloadSelector, the filter might not apply to your my-service pods.
• Incomplete header removal: The Lua script only removes one case variant of the header.

Replacement for Deprecated reject_unsupported_transfer_encodings Flag #

In Envoy 1.16.1, the reject_unsupported_transfer_encodings flag was replaced with settings in the http_connection_manager config. You can apply these via an EnvoyFilter:

Option 1: Allow Duplicate Headers & Unknown Transfer Encodings #

This config tells Envoy to merge duplicate headers and tolerate non-standard transfer encodings:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: allow-duplicate-transfer-encoding
  namespace: istio-system
spec:
  configPatches:
    - applyTo: HTTP_CONNECTION_MANAGER
      match:
        context: ANY  # Adjust to SIDECAR_INBOUND or GATEWAY if needed
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
      patch:
        operation: MERGE
        value:
          codec_settings:
            merge_duplicate_headers: true
          http_protocol_options:
            allow_unknown_transfer_encoding: true

Option 2: Lua Script to Fully Clean Transfer-Encoding Headers #

For more control, use a corrected EnvoyFilter with Lua to remove all variants of the Transfer-Encoding header, regardless of case:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: clean-transfer-encoding
  namespace: my-ns
spec:
  workloadSelector:
    labels:
      app: my-service  # Match your service's pod labels
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.lua
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
            inlineCode: |
              function envoy_on_response(response_handle)
                local headers = response_handle:headers()
                -- Collect all header keys that match "transfer-encoding" (case-insensitive)
                local headers_to_remove = {}
                for key, _ in pairs(headers) do
                  if string.lower(key) == "transfer-encoding" then
                    table.insert(headers_to_remove, key)
                  end
                end
                -- Remove all matching headers
                for _, key in ipairs(headers_to_remove) do
                  headers:remove(key)
                end
              end

Final Recommendations #

1. Start with updating your VirtualServices to remove both case variants of the header—this is the simplest fix if it works.
2. If the VirtualService approach still fails, use the corrected Lua EnvoyFilter to ensure all duplicate headers are stripped.
3. For the deprecated flag replacement, the merge_duplicate_headers + allow_unknown_transfer_encoding config is a direct substitute to prevent Envoy from rejecting responses with duplicate transfer encodings.

内容的提问来源于stack exchange，提问作者Eugene G