Session Persistence

Session Persistence allows client requests to be consistently routed to the same backend service instance. This is useful in many scenarios, such as when an application needs to maintain state across multiple requests. In Envoy Gateway, session persistence can be enabled by configuring HTTPRoute.

Envoy Gateway supports following session persistence types:

• Cookie-based Session Persistence: Session persistence is achieved based on specific cookie information in the request.
• Header-based Session Persistence: Session persistence is achieved based on specific header information in the request.

Prerequisites

Install Envoy Gateway

Follow the steps below to install Envoy Gateway and the example manifest. Before proceeding, you should be able to query the example backend using HTTP.

For better testing the session persistence, you can add more hosts in upstream cluster by increasing the replicas of one deployment:

kubectl patch deployment backend -n default -p '{"spec": {"replicas": 4}}'

Cookie-based Session Persistence

• Apply from stdin
• Apply from file

cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: cookie
spec:
  parentRefs:
    - name: eg
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: backend
          port: 3000
      sessionPersistence:
        sessionName: Session-A
        type: Cookie
        absoluteTimeout: 10s
        cookieConfig:
          lifetimeType: Permanent
EOF

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: cookie
spec:
  parentRefs:
    - name: eg
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: backend
          port: 3000
      sessionPersistence:
        sessionName: Session-A
        type: Cookie
        absoluteTimeout: 10s
        cookieConfig:
          lifetimeType: Permanent

After updating the ConfigMap, you will need to wait the configuration kicks in.
You can force the configuration to be reloaded by restarting the envoy-gateway deployment.

kubectl rollout restart deployment envoy-gateway -n envoy-gateway-system

Testing

Send a request to get a cookie and test:

COOKIE=$(curl --verbose http://localhost:8888/get 2>&1 | grep "set-cookie" | awk '{print $3}')
for i in `seq 5`; do
    curl -H "Cookie: $COOKIE" http://localhost:8888/get 2>/dev/null | grep pod
done

You can see all responses are from the same pod:

 "pod": "backend-765694d47f-lxwdf"
 "pod": "backend-765694d47f-lxwdf"
 "pod": "backend-765694d47f-lxwdf"
 "pod": "backend-765694d47f-lxwdf"
 "pod": "backend-765694d47f-lxwdf"

Wait for cookie expiration, test again:

sleep 10 && for i in `seq 5`; do
    curl -H "Cookie: $COOKIE" -H "Host: www.example.com" http://localhost:8888/get 2>/dev/null | grep pod
done

 "pod": "backend-765694d47f-kvwqb"
 "pod": "backend-765694d47f-lxwdf"
 "pod": "backend-765694d47f-kvwqb"
 "pod": "backend-765694d47f-2ff9s"
 "pod": "backend-765694d47f-lxwdf"

Due to cookie expiration, no session any more.

Header-based Session Persistence

• Apply from stdin
• Apply from file

cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: header
spec:
  parentRefs:
    - name: eg
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: backend
          port: 3000
      sessionPersistence:
        sessionName: Session-A
        type: Header
        absoluteTimeout: 10s
EOF

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: header
spec:
  parentRefs:
    - name: eg
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: backend
          port: 3000
      sessionPersistence:
        sessionName: Session-A
        type: Header
        absoluteTimeout: 10s

Testing

Send a request to get a cookie and test:

HEADER=$(curl --verbose http://localhost:8888/get 2>&1 | grep "session-a" | awk '{print $3}')
for i in `seq 5`; do
    curl -H "Session-A: $HEADER" http://localhost:8888/get 2>/dev/null | grep pod
done

You can see all responses are from the same pod:

 "pod": "backend-765694d47f-gn7q2"
 "pod": "backend-765694d47f-gn7q2"
 "pod": "backend-765694d47f-gn7q2"
 "pod": "backend-765694d47f-gn7q2"
 "pod": "backend-765694d47f-gn7q2"

We remove the header and test again:

for i in `seq 5`; do
    curl http://localhost:8888/get 2>/dev/null | grep pod
done

 "pod": "backend-765694d47f-2ff9s"
 "pod": "backend-765694d47f-kvwqb"
 "pod": "backend-765694d47f-2ff9s"
 "pod": "backend-765694d47f-lxwdf"
 "pod": "backend-765694d47f-kvwqb"