Some HTTP/2 requests fail with duplicate value in envoy authority request header

[SeanKilleen]

A continuation of #18447, which was previously closed.

After removing our prior workaround recently, I noted that the issue persisted.

There was some confusion between myself and the Istio team -- changes that I thought were back-ported to Envoy 1.28.x and 1.27.x were not. The Istio member was asking me to work to get the changes back-ported, but their wording gave me the impression that the changes had been back-ported.

As such, the issue persists and a fix is not yet available for Kyma. Therefore, opening this to track the state of that fix as I work through it with the Istio team.

[SeanKilleen]

Update on this:

• I have worked with Envoy to get the fix back-ported. It will be available in their upcoming 1.28.2 and 1.27.4 releases. Those releases are being worked on now.
• I have asked Istio about the path to incorporating these changes, presumably in a 1.20.5 release. That's being tracked via my reopened issue at https://github.com/istio/istio/issues/48088

CC @barchw as FYI because they were on the last Kyma ticket I wrote up on this subject.

ℹ️ Istio module 1.4.1 appears to use Istio 1.20.3 as far as I can tell from our environment, which will still have this issue.

[barchw]

I will add it to our backlog. Fyi: Istio module 1.5.0 release is just around the corner, it will already have 1.21.0 Istio version.

[SeanKilleen]

ℹ️ The fix for this issue is now included in the Istio 1.20.5 release.

If you produce v1.4.3 of the Istio module and bump the release to 1.20.5, the issue will likely be resolved. But I won't pretend to know what other considerations have to go into something like that at your scale! :)

Looking forward to seeing these changes roll into Kyma soon either in the next 1.5 or 1.4.x module. Thanks for your willingness to engage with this in public!

[SeanKilleen]

Nevermind, I see the 1.5x module is already available. I'll have to wait until it rolls out to us on BTP Kyma and then check. 👍

[barchw]

Hey @SeanKilleen, Istio module 1.5 (with Istio 1.21.1) rolled out to Regular channel last week, you should have it already on your cluster.

[github-actions[bot]]

This issue has been automatically marked as stale due to the lack of recent activity. It will soon be closed if no further activity occurs. Thank you for your contributions.