istio / istio/api

Add support for "in" multiple values header match in virtualservice

Open
#3,731 0 comments 0 reactions 0 assignees View on GitHub
area/networking area/user experience kind/docs kind/enhancement
Dominant language
Go
Stars
519
Forks
612
Avg merge
18h 35m
Merged PRs (30d)
23

Description

**Describe the feature request**

Right now, the `virtualService` spec supports header based routing which is one of the fundamental features core to istio. A typical scenario would be to say, allow an ingress request if a particular header is in a list of allowed values.

One way to do this today is to have multiple header entries in the match list
```yaml
match:
- headers:
x-env:
exact: prod
- headers:
x-env:
exact: stage
- headers:
x-env:
exact: dev
```
This could work for cases like env filtering, but if it's something like user, team or company filtering the list can get quite huge... increasing the CR size and degraded devX

or have a regex match with a list... This has clear limitations of performance, faulty regexes and the 1024 character limit preventing bigger lists

This issue proposes having a "in" semantic here which would simplify the CR, improve devX and potentially help with perf
```yaml
headers:
x-tenant:
in:
- foo
- bar
- baz
```

**Describe alternatives you've considered**
On the user end, there are two ways folks currently work around this, apart from the obvious regex hack...
- yaml anchors reusing blocks, not ideal since these only work on repeated maps
- having custom helm templates over the vs spec to iterate that way, solves dx with downstream maintainability setback

**Affected product area (please put an X in all that apply)**

[ ] Configuration Infrastructure
[x] Docs
[ ] Installation
[x] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[x] User Experience

**Additional context**

Contributor guide

Open the contributing guide

Research direction

Start by locating the VirtualService specification and its header-based match schema in this API repository. Review how exact and regex header matches are represented, then determine how an `in` list should be validated and translated. Done means the schema supports the proposed values and routing behavior is covered by appropriate tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, networking
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.