Control Headers and Routing (Deprecated)
This task demonstrates how to use a policy adapter to manipulate request headers and routing.
Before you begin
Set up Istio on Kubernetes by following the instructions in the Installation guide4.
Follow the set-up instructions in the ingress task6 to configure an ingress using a gateway.
Customize the virtual service7 configuration for the
httpbin
service containing two route rules that allow traffic for paths/headers
and/status
:
Output-producing adapters
In this task, we are using a sample policy adapter keyval
. In addition to
a policy check result, this adapter returns an output with a single field
called value
. The adapter is configured with a lookup table, which it uses to
populate the output value, or return NOT_FOUND
error status if the input
instance key is not present in the lookup table.
Deploy the demo adapter:
Enable the
keyval
adapter by deploying its template and configuration descriptors:Create a handler for the demo adapter with a fixed lookup table:
Create an instance for the handler with the
user
request header as a lookup key:
Request header operations
Ensure the httpbin service is accessible through the ingress gateway:
The output should be the request headers as they are received by the httpbin service.
Create a rule for the demo adapter:
Issue a new request to the ingress gateway with the header
key
set to valuejason
:Note the presence of the
user-group
header with the value derived from the rule application of the adapter. The expressionx.output.value
in the rule evaluates to the populatedvalue
field returned by thekeyval
adapter.Modify the rule to rewrite the URI path to a different virtual service route if the check succeeds:
Repeat the request to the ingress gateway:
Note that the ingress gateway changed the route after the rule application of the policy adapter. The modified request may use a different route and destination and is subject to the traffic management configuration.
The modified request is not checked again by the policy engine within the same proxy. Therefore, we recommend to use this feature in gateways, so that the server-side policy checks take effect.
Cleanup
Delete the policy resources for the demo adapter:
Complete the clean-up instructions in ingress task6.