Istio EnvoyFilter Causes 503 Errors

You encounter a istio configuration issue that prevents your workflow from completing. This guide walks through the fix step by step.

Wrong ❌

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata: { name: my-filter }
spec:
  workloadSelector: { labels: { app: my-service } }
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener: { portNumber: 8080, filterChain: { filter: { name: envoy.filters.network.http_connection_manager } } }
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.lua
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
            inline_code: |
              function envoy_on_request(request_handle)
                -- invalid lua crashes the filter
              end

Wrong Output

All requests return 503. Envoy logs: unable to load Lua filter. EnvoyFilter rejected.

Right ✅

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata: { name: my-filter }
spec:
  workloadSelector: { labels: { app: my-service } }
  configPatches:
    - applyTo: HTTP_FILTER
      match: { context: SIDECAR_INBOUND }
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.lua
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
            inline_code: |
              function envoy_on_request(request_handle)
                request_handle:headers():add("x-custom", "true")
              end

Right Output

Requests processed with x-custom header. Envoy proxy SYNCED. No errors.

Prevention

• Test EnvoyFilter patches in staging first.
• Validate Lua syntax before applying.
• Use istioctl proxy-status to check sync.
• Start simple and incrementally add complexity.
• Check Envoy logs: kubectl logs -c istio-proxy.

DodaTech applies similar defensive patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro infrastructure for production reliability.

Common Mistakes with envoy filter

1. Using head and tail instead of pattern matching, causing runtime errors on empty lists
2. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
3. Using return to exit a function early instead of wrapping a pure value in the monad

These mistakes appear frequently in real-world ISTIO code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

This quick fix is part of the DodaTech infrastructure engineering series. Learn more at DodaTech tutorials.