I initially created an EnvoyFilter to apply idle_timeout of 5s to outbound requests originating from workloads with label app: mecha-dev.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
  name: tcp-idle-timeout
      app: mecha-dev
    - listenerMatch:
        listenerType: SIDECAR_OUTBOUND
        listenerProtocol: TCP
      filterName: envoy.tcp_proxy
      filterType: NETWORK
        idle_timeout: 5s

However, the filter did not work for me and I found out it was because my cluster is using istio v1.2.5 which is a very old version and does not support EnvoyFilters properly and the envoy API for the same have been deprecated.

Therefore, I deleted the EnvoyFilter using kubectl.

But, even after deletion of the filter the istio-proxy sidecar containers keep on showing me the following error again and again:

[2021-05-11 11:59:14.109][22][warning][config] [external/envoy/source/common/config/grpc_mux_subscription_impl.cc:73] gRPC config for type.googleapis.com/envoy.api.v2.Listener rejected: Error adding/updating listener(s) Proto constraint validation failed (TcpProxyValidationError.StatPrefix: ["value length must be at least " '\x01' " bytes"]): idle_timeout {
  seconds: 5

I deleted the pods and re-created new ones but this error keeps on showing up. Is there anything else I need to clean up or delete to get rid of this error?


As you already realised, EnvoyFilter was not yet supported in Istio 1.2.5.
Using old, unsupported versions of software exposes you to these types of cases. In this situation, your best bet would be to upgrade to newer version of Istio and recreate EnvoyFilter the way you initially wanted.

Also, please be aware that filterName envoy.tcp_proxy is depracted since envoy 1.4.0. You should use envoy.filters.network.tcp_proxy instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.