Feature Request: support more global configuration

[zzjin]

Why do you need it?

we need to use a large size of request header.

How could it be?

Since envoy can set max_request_headers_kb to big ones, so like higress can also support or expose it would be better.

Other related information

Tried https://discuss.istio.io/t/istio-ingress-increase-header-size/9003/8 , but not works.

[johnlanni]

1. Make sure enable the istio API: https://higress.io/zh-cn/docs/ops/deploy-by-helm#%E6%94%AF%E6%8C%81-istio-crd%E5%8F%AF%E9%80%89
2. Try this one:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name:  hcm-options
  namespace: higress-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          max_request_headers_kb: 8192

Note that the maximum request header size is 8MB, which is limited by the Envoy implementation.

[johnlanni]

We should support more global configurations through configmap, which is provided by this code. Then users don't need use the istio's envoyfilter to implement it.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name:  global-options
  namespace: higress-system
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: MERGE
      value:
        name: envoy.filters.network.http_connection_manager
        typed_config:
          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          common_http_protocol_options:
            # connection idle
            idle_timeout: 180s
          # http2 optimize
          http2_protocol_options:
            initial_connection_window_size: 1048576
            initial_stream_window_size: 65535
            max_concurrent_streams: 100
          # request idle
          stream_idle_timeout: 180s
  - applyTo: LISTENER
    match:
      context: GATEWAY
    patch:
      operation: MERGE
      value:
        # max buffer size per connection
        per_connection_buffer_limit_bytes: 32768

If anyone wants to claim this issue, you can comment below.

[lcfang]

通过配置configmap来代替配置Envoyfilter，但实际上还是转换成Envoyfilter的吧？

[johnlanni]

@lcfang 是的，可以参考 tracing 功能的实现：https://github.com/alibaba/higress/blob/main/pkg/ingress/kube/configmap/tracing.go

[lcfang]

这个有人在做了吗？没有的话我领一下吧 @johnlanni

[lcfang]

这个感觉有很多envoyfilter的配置可以按照这种方式做啊，难道要一个配置一个controller来做吗？

[johnlanni]

@lcfang 麻烦加一下OPS SIG的钉钉群：45280001966
需要一起讨论下这块设计