Breaking change in Istio 1.5 headers regex

[stefanprodan]

Istio 1.5 doesn't allow negative lookahead regex.

With Istio 1.4 it was possible to target a specific browser e.g.:

match:
  - headers:
      user-agent:
        regex: "^(?!.*(?:Chrome|Edge)).*Safari.*"

Such a configuration doesn't work with Istio 1.5, the gateway rejects it:

RouteConfiguration rejected: invalid perl operator: (?!

Upgrading from Istio 1.4 to Istio 1.5 will result in downtime if you are using negative lookahead regex in virtual services.

[stefanprodan]

Long story short: Envoy has switched to Google's re2
regex engine in envoyproxy/envoy#7878 and re2 does not support before/after text not matching https://github.com/google/re2/wiki/Syntax.