istio: Websockets with WSS are not working due to EnvoyFilter conflicts

Bug Description

#9152 is still not resolved.

I’ve narrowed it down to WSS failing to upgrade if there are other EnvoyFilters added. E.g in my case, having a request limit size filter will break the WSS and fail to initiate 101 Switching Protocols. Here’s an example of such a filter:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: max-request-size
  namespace: istio-system
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: "envoy.filters.http.router"
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.buffer
        typed_config:
          '@type': type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer
          max_request_bytes: 52428800

All this does is just increase the limit of client body size to 50Mb. This issue persists throughout istio 1.11-1.12 and kubernetes 1.19-1.20.

Version

➜ istioctl version
client version: 1.12.1
control plane version: 1.12.1
data plane version: 1.12.1 (35 proxies)

➜ kubectl version --short
Client Version: v1.22.0
Server Version: v1.20.11

Additional Information

No response