AttributeGen Config

AttributeGen plugin uses builtin attributes as inputs and produces new attributes that can be used by downstream plugins.

The following is an example of a configuration that produces one attribute named istio_operationId using request.url_path and request.method.

  1. {
  2.   "attributes": [
  3.     {
  4.       "output_attribute": "istio_operationId",
  5.       "match": [
  6.         {
  7.           "value": "ListBooks",
  8.           "condition": "request.url_path == '/books' && request.method ==
  9.           'GET'"
  10.         },
  11.         {
  12.           "value": "GetBook",
  13.           "condition":
  14.           "request.url_path.matches('^/shelves/[[:alnum:]]*/books/[[:alnum:]]*$')
  15.           && request.method == 'GET'"
  16.         },
  17.         {
  18.           "value": "CreateBook",
  19.           "condition": "request.url_path == '/books/' && request.method ==
  20.           'POST'"
  21.         }
  22.       ]
  23.     }
  24.   ]
  25. }

If the Stats plugin runs after AttributeGen, it can use istio_operationId to populate a dimension on a metric.

The following is an example of response codes being mapped into a smaller number of response classes as the istio_responseClass attribute. For example, all response codes in 200s are mapped to 2xx.

  1. {
  2.   "attributes": [
  3.     {
  4.       "output_attribute": "istio_responseClass",
  5.       "match": [
  6.         {
  7.           "value": "2xx",
  8.           "condition": "response.code >= 200 && response.code <= 299"
  9.         },
  10.         {
  11.           "value": "3xx",
  12.           "condition": "response.code >= 300 && response.code <= 399"
  13.         },
  14.         {
  15.           "value": "404",
  16.           "condition": "response.code == 404"
  17.         },
  18.         {
  19.           "value": "429",
  20.           "condition": "response.code == 429"
  21.         },
  22.         {
  23.           "value": "503",
  24.           "condition": "response.code == 503"
  25.         },
  26.         {
  27.           "value": "5xx",
  28.           "condition": "response.code >= 500 && response.code <= 599"
  29.         },
  30.         {
  31.           "value": "4xx",
  32.           "condition": "response.code >= 400 && response.code <= 499"
  33.         }
  34.       ]
  35.     }
  36.   ]
  37. }

If multiple AttributeGene configurations produce the same attribute, the result of the last configuration will be visible to downstream filters.

PluginConfig

Top level configuration to generate new attributes based on attributes of the proxied traffic.

FieldTypeDescriptionRequired
debugbool

The following settings should be rarely used. Enable debug for this filter.

No
attributesAttributeGeneration[]

Multiple independent attribute generation configurations.

No

AttributeGeneration

AttributeGeneration define generation of one attribute.

FieldTypeDescriptionRequired
outputattributestring

The name of the attribute that is populated on a successful match. An attribute name SHOULD NOT contain a .. You may use underscores for namespacing instead.

Example: istio_operationId

istio attribute namespace is reserved by Istio.

AttributeGeneration may fail to evaluate when an attribute is not available. For example, response.code may not be available when a request ends abruptly. When attribute generation fails, it will not populate the attribute.

If the generated attribute is used by an authz plugin, it should account for the possibility that the attribute may be missing. Use has(attribute_name) function to check for presence of an attribute before using its value, and provide appropriate defaults. For example the following is a safe use of response.code

has(response.code)?response.code:200

No
matchMatch[]

Matches are evaluated in order until the first successful match. The value specified by the successful match is assgined to the output_attribute.

No

Match

If the condition evaluates to true then the Match returns the specified value.

FieldTypeDescriptionRequired
conditionstring

The condition is a CEL expression that may use builtin attributes.

Example:

  1.    {
  2.      “value”: “GetBook”,
  3.      “condition”:
  4.      “request.url_path.matches(‘^/shelves/[[:alnum:]]/books/[[:alnum:]]$’)
  5.      && request.method == ‘GET’”
  6.    },

Note: CEL uses re2 regex library. Use anchors {^, $} to ensure that the regex evaluates efficiently.

Note: request.url_path is normalized and stripped of query params.

a Read only operation on books

  1. { “value”: “ReadOnlyBooks”,
  2.   “condition”: “request.url_path.startsWith(‘/books/‘) &&
  3.   in(request.method, [‘GET’, ‘HEAD’])”}

An empty condition evaluates to true and should be used to provide a default value.

No
valuestring

If condition evaluates to true, return the value.

No