Gloo Portal not compatible with Istio 1.9.1 due to dev-portal-global-filter-istio-ingressgateway

[murphye]

Describe the bug

The dev-portal-global-filter-istio-ingressgateway Envoy filter seems to be incompatible with Istio 1.9.1. This is blocking Envoy config updates to the Istio Ingress Gateway, resulting in warnings as such:

warn    Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 1 successful, 0 rejected; lds updates: 0 successful, 1 rejected

The only way to find an issue was to run istioctl analyze --all-namespaces as everything else seems to be normal.

Warnings related to dev-portal-global-filter-istio-ingressgateway

istioctl analyze --all-namespaces                                                                                                                                                                                             127 ↵
Warning [IST0123] (Namespace istio-operator) The namespace has both new and legacy injection labels. Run 'kubectl label namespace istio-operator istio.io/rev-' or 'kubectl label namespace istio-operator istio-injection-'
Warning [IST0133] (EnvoyFilter dev-portal-global-filter-istio-ingressgateway.istio-system) Schema validation warning: using deprecated filter name "envoy.ext_authz"; use "envoy.filters.http.ext_authz" instead
Warning [IST0133] (EnvoyFilter dev-portal-global-filter-istio-ingressgateway.istio-system) Schema validation warning: using deprecated filter name "envoy.http_connection_manager"; use "envoy.filters.network.http_connection_manager" instead
Warning [IST0133] (EnvoyFilter dev-portal-global-filter-istio-ingressgateway.istio-system) Schema validation warning: using deprecated filter name "envoy.router"; use "envoy.filters.http.router" instead
Warning [IST0133] (EnvoyFilter dev-portal-global-filter-istio-ingressgateway.istio-system) Schema validation warning: using deprecated type_url(s); type.googleapis.com/envoy.config.filter.http.ext_authz.v2.ExtAuthz
Warning [IST0133] (EnvoyFilter dev-portal-global-filter-istio-ingressgateway.istio-system) Schema validation warning: using deprecated type_url(s); type.googleapis.com/envoy.config.filter.http.rate_limit.v2.RateLimit
Info [IST0102] (Namespace dev-portal) The namespace is not enabled for Istio injection. Run 'kubectl label namespace dev-portal istio-injection=enabled' to enable it, or 'kubectl label namespace dev-portal istio-injection=disabled' to explicitly mark it as not needing injection.

After running kubectl delete envoyfilters -n istio-system dev-portal-global-filter-istio-ingressgateway envoyfilter.networking.istio.io the Istio Ingress became operable again as the Envoy proxy is NOT ready warning went away.

To Reproduce Steps to reproduce the behavior:

1. Install Gloo Portal for Istio Ingress
2. Add APIProduct, Environment

At this point, the VirtualService will be created correctly, but if you curl a route from the VirtualService there will be 404 errors. This is because the Envoy config is not being propagated to Istio Ingress.

Additional context

Lin made a comment "envoy filter is alpha api and it changes from istio releases to releases. so we need to review them every istio release"

[marcogschmidt]

Closing this as it is a duplicate of https://github.com/solo-io/dev-portal/issues/1261

[murphye]

Duplicate