istio: Istio Virtual Service is unable to append value to already available request header with HeaderOptions

Is this the right place to submit this?

• This is not a security vulnerability or a crashing bug
• This is not a question about how to use Istio

Bug Description

Hi Team, I am using request header add options provided by Istio Virtual service. https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers-HeaderOperations

• Ideally, when a request is received by istio Virtual Service, It should be able append some additional headers based on the configuration detail.

But, I am facing an issue where,

• If the headers with key “baggage” is already present, then istio is unable to append the value to the already existing headers.

• If the headers with key “baggage” is not present, then istio is able to add the value to already existing headers.

Eg : Before receiving the request, If in headers, baggage = flow_name=canarytest.canary-app1–other,req_zone_name=test-zone.

When istio virtual service receives the request, it should append “x-canary=true” in already present baggage header. Now, it should be something like below baggage =flow_name=canarytest.canary-app1–other,req_zone_name=test-zone, x-canary=true

But, Istio virtual service is unable to modify.

• Not only baggage headers, I am facing this issue for other headers(with different name) as well.

In the official documentation, it was mentioned that,

add	map<string, string>	Append the given values to the headers specified by keys (will create a comma-separated list of values)

header options “add” supports this. But, it is not working.

Note : I am not facing issue with traffic routing, I am only facing issue with request headers add feature.

Need this help on urgent basis.

Please refer to below sample virtual service.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
  name: canary-app2
  namespace: canarytest
spec:
  exportTo:
  - .
  hosts:
  - canary-app2
  http:
  - match:
    - headers:
        baggage:
          regex: .*x-canary=true.*
    route:
    - destination:
        host: canary-app2
        subset: canary
  - name: primary
    route:
    - destination:
        host: canary-app2
        subset: stable
      weight: 100
    - destination:
        host: canary-app2
        subset: canary
      headers:
        request:
          add:
            baggage: x-canary=true

Version

control plane - 1.18.2-distroless
istio-operator - 1.18.2-distroless

Additional Information

Istio virtual service header options is unable to append value to a already existing key in headers.

https://istio.io/latest/docs/reference/config/networking/virtual-service/#Headers-HeaderOperations