TIS0803 - REPLACE Operation Only Valid for HTTP_FILTER and NETWORK_FILTER

The REPLACE operation is only valid for HTTP_FILTER and NETWORK_FILTER.

Recommendation: Ensure REPLACE Operation is Used with Compatible applyTo Values

To prevent configuration errors, either remove the REPLACE operation when applyTo is not HTTP_FILTER or NETWORK_FILTER, or change applyTo to a compatible value.

Examples

1. Incorrect REPLACE Operation with applyTo Field

   apiVersion: networking.istio.io/v1alpha3
   kind: EnvoyFilter
   metadata:
     name: invalid-replace-operation
     namespace: example-namespace
   spec:
     configPatches:
     - applyTo: ROUTE_CONFIGURATION
       match:
         context: GATEWAY
       patch:
         operation: REPLACE
         value:
           name: "route-config"

   Explanation: The EnvoyFilter specifies a REPLACE operation with applyTo set to ROUTE_CONFIGURATION, but REPLACE is only valid for HTTP_FILTER and NETWORK_FILTER. As a result, the configuration will be ignored.

Recommendation

Remove the REPLACE operation or change the applyTo field to a valid value.

1. Remove the REPLACE Operation

   If replacing the configuration is not necessary, delete the REPLACE operation to ensure the configuration is valid.

   apiVersion: networking.istio.io/v1alpha3
   kind: EnvoyFilter
   metadata:
     name: corrected-operation
     namespace: example-namespace
   spec:
     configPatches:
     - applyTo: ROUTE_CONFIGURATION
       match:
         context: GATEWAY
       patch:
         operation: MERGE
         value:
           name: "existing-route-config"

   Explanation: By changing the operation from REPLACE to MERGE, the configuration is now valid for applyTo: ROUTE_CONFIGURATION.

2. Change applyTo to a Valid Value for REPLACE

   If the intention is to replace a filter, change the applyTo field to a value that supports the REPLACE operation.

   apiVersion: networking.istio.io/v1alpha3
   kind: EnvoyFilter
   metadata:
     name: replace-operation-corrected
     namespace: example-namespace
   spec:
     configPatches:
     - applyTo: HTTP_FILTER
       match:
         context: SIDECAR_OUTBOUND
       patch:
         operation: REPLACE
         value:
           name: "envoy.filters.http.router"

   Explanation: Changing applyTo to HTTP_FILTER allows the REPLACE operation to be used, as replacing HTTP filters is valid for this applyTo value.