Istio中如何无需修改服务源码将指定Header传递至上游服务？

Great question! Let’s walk through the cleanest ways to pass custom headers like foo from Service A to Service B in Istio—no service code changes needed. You’re right that some Istio resources can be tricky to get right, so let’s break down what you might have missed and the best solutions:

1. Use VirtualService (The Simplest Native Approach) #

You mentioned VirtualService headers didn’t work as expected—chances are you weren’t configuring the right part of the VirtualService. Istio’s VirtualService lets you explicitly retain or pass headers to upstream services when defining routes between services.

Example Configuration #

If Service A is calling Service B, create a VirtualService targeting Service B (or attach this rule to Service A’s outbound routes) to ensure the foo header is passed:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: service-b-route
spec:
  hosts:
    - service-b.default.svc.cluster.local
  http:
    - match:
        # Optional: Restrict this rule to requests from Service A
        - sourceLabels:
            app: service-a
          uri:
            prefix: /
      route:
        - destination:
            host: service-b.default.svc.cluster.local
      headers:
        request:
          # Explicitly keep the incoming `foo` header to pass to Service B
          # Use this if Istio’s default filtering is blocking the header
          keep:
            - foo
          # If you need to add a fixed-value header (not pass the original), use `set` instead:
          # set:
          #   foo: "static-value"

Why This Works #

Istio passes most custom headers by default, but if your foo header is being dropped, it might fall into a small set of "filtered" headers (rare for custom names). The keep directive forces Istio to retain and forward the header to the upstream service.

2. Envoy Filter for Advanced/Grouped Header Passing #

If you need to pass a group of headers (e.g., all x-custom-* headers) or add conditional logic, an Envoy Filter is the way to go. You don’t need complex Lua scripts—use Envoy’s built-in header_transformation filter for a clean implementation.

Example: Pass Specific Headers #

This filter runs on Service A’s sidecar and forwards foo (and any other headers you add) to Service B:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: pass-custom-headers
  namespace: default
spec:
  workloadSelector:
    labels:
      app: service-a # Target only Service A's sidecar
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        listener:
          portNumber: 8080 # Adjust to your service's port
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.header_transformation
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.header_transformation.v3.HeaderTransformation"
            request_transform:
              headers_to_add:
                - header:
                    key: "foo"
                    value: "%REQ(foo)%" # Reference the incoming header value
                # Add more headers here as needed
                # - header:
                #     key: "x-custom-bar"
                #     value: "%REQ(x-custom-bar)%"

Example: Pass a Group of Headers #

If you want to forward all headers matching a pattern (e.g., x-*), use a Lua script in the Envoy Filter:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: pass-patterned-headers
  namespace: default
spec:
  workloadSelector:
    labels:
      app: service-a
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_OUTBOUND
        listener:
          portNumber: 8080
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.lua
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
            inline_code: |
              function envoy_on_request(request_handle)
                -- Forward all headers starting with "x-"
                for key, value in pairs(request_handle:headers()) do
                  if string.find(key:lower(), "^x-") then
                    request_handle:headers():set(key, value)
                  end
                end
                -- Also explicitly forward the `foo` header
                local foo_val = request_handle:headers():get("foo")
                if foo_val ~= nil then
                  request_handle:headers():set("foo", foo_val)
                end
              end

3. Check Istio Mesh-Wide Header Filtering #

Before diving into filters, verify if Istio’s mesh configuration is accidentally dropping your header. Check the Istio config map for any global header removal rules:

kubectl get configmap istio -n istio-system -o yaml | grep -A 15 "headersToRemove"

If foo is listed here, you’ll need to update the mesh config to remove it from the headersToRemove list.

内容的提问来源于stack exchange，提问作者Oleg Butuzov