Home / server / Questions / 1063240
In Process
bakadevops
Asked: 2021-05-12 08:46:12 +0800 CST

Istio Keeps On Showing TcpProxyValidationError Errors

  • 772

I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: tcp-idle-timeout
spec:
  workloadSelector:
    labels:
      app: mecha-dev
  filters:
    - listenerMatch:
        listenerType: SIDECAR_OUTBOUND
        listenerProtocol: TCP
      filterName: envoy.tcp_proxy
      filterType: NETWORK
      filterConfig:
        idle_timeout: 5s

However, the filter did not work for me and I found out it was because my cluster is using istio v1.2.5 which is a very old version and does not support EnvoyFilters properly and the envoy API for the same have been deprecated.

Therefore, I deleted the EnvoyFilter using kubectl.

But, even after deletion of the filter the istio-proxy sidecar containers keep on showing me the following error again and again:

[2021-05-11 11:59:14.109][22][warning][config] [external/envoy/source/common/config/grpc_mux_subscription_impl.cc:73] gRPC config for type.googleapis.com/envoy.api.v2.Listener rejected: Error adding/updating listener(s) 10.155.0.113_443: Proto constraint validation failed (TcpProxyValidationError.StatPrefix: ["value length must be at least " '\x01' " bytes"]): idle_timeout {
  seconds: 5
}

I deleted the pods and re-created new ones but this error keeps on showing up. Is there anything else I need to clean up or delete to get rid of this error?

kubernetes istio envoyproxy

1 Answers

  1. As you already realised, EnvoyFilter was not yet supported in Istio 1.2.5.
    Using old, unsupported versions of software exposes you to these types of cases. In this situation, your best bet would be to upgrade to newer version of Istio and recreate EnvoyFilter the way you initially wanted.

    Also, please be aware that filterName envoy.tcp_proxy is depracted since envoy 1.4.0. You should use envoy.filters.network.tcp_proxy instead.

    • 0