2

I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-idle-timeout
spec:
  workloadSelector:
    labels:
      app: mecha-dev
  filters:
    - listenerMatch:
        listenerType: SIDECAR_OUTBOUND
        listenerProtocol: TCP
      filterName: envoy.tcp_proxy
      filterType: NETWORK
      filterConfig:
        idle_timeout: 5s

However, the filter did not work for me and I found out it was because my cluster is using istio v1.2.5 which is a very old version and does not support EnvoyFilters properly and the envoy API for the same have been deprecated.

Therefore, I deleted the EnvoyFilter using kubectl.

But, even after deletion of the filter the istio-proxy sidecar containers keep on showing me the following error again and again:

[2021-05-11 11:59:14.109][22][warning][config] [external/envoy/source/common/config/grpc_mux_subscription_impl.cc:73] gRPC config for type.googleapis.com/envoy.api.v2.Listener rejected: Error adding/updating listener(s) 10.155.0.113_443: Proto constraint validation failed (TcpProxyValidationError.StatPrefix: ["value length must be at least " '\x01' " bytes"]): idle_timeout {
  seconds: 5
}

I deleted the pods and re-created new ones but this error keeps on showing up. Is there anything else I need to clean up or delete to get rid of this error?

Improve this question
5
  • 1
    Have you deleted workloads only? Have you restarted controlplane as well (pods in istio-system namespace)?
    – Kyslik
    May 12, 2021 at 10:42
  • @Kyslik there are a bunch of pods in istio-system namespace, do I gotta restart all?
    – bakadevops
    May 12, 2021 at 11:44
  • 1
    Unless you run your production workloads on that cluster, yes. You gotta test things like this one way or another... I don't remember what components Istio 1.2 have, but I'd start with pilot or mixer.
    – Kyslik
    May 12, 2021 at 11:48
  • 1
    It is not a prod workload so I can test these out.
    – bakadevops
    May 12, 2021 at 11:49
  • 1
    @Kyslik after restarting pilot and mixer the errors were gone. Thanks for the suggestion.
    – bakadevops
    May 12, 2021 at 13:19

1 Answer 1

Reset to default
1

Restarting Istio controlplane should fix the issue on hand (pods in istio-system, most likely pilot).

More importantly do not run Istio 1.2 its very outdated version with many bugs and security issues.

Improve this answer
1
  • Yes, we are abolishing the old version. This was just a plan to mitigate some connection issues while we setup our new clusters with latest istio.
    – bakadevops
    May 12, 2021 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.