can istio support route to different service by dynamic part of uri path

Question

I know istio is supporting route to different service by static rule as below:

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-virtualservice
spec:
  hosts:
  - "*"
  gateways:
  - my-gateway
  http:
  - match:
    - uri:
        prefix: /applications/app-a
    route:
    - destination:
        host: app-a
        port:
          number: 9080

But i have the requirement that, I have dynamically created services when there is new user or new configuration is coming. If i use the "static" way, then I have to create new virtual service every time or update existing virtual service.

I don't find any documentation mentioned this kind of usage, but can i use something like "regex" or some other way to create one rule to apply to all those new created services without updating virtual service every time? Below is something not work, but try to demonstrate my idea:

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-virtualservice
spec:
  hosts:
  - "*"
  gateways:
  - my-gateway
  http:
  - match:
    - uri:
        regex: /applications/(?<appname>.*)
    route:
    - destination:
        host: $('appname')--svc
        port:
          number: 9080

Of course, any suggestion would be greatly appreciated. Thanks.

Answer 1

I do not think Istio can do what you ask. The good side of it is that you must control all the entry points into your cluster - which application is accessible and how it is accessible - less security holes.

Answer 2

I am not sure but on github they use regexp in VirtualService:

  - match:
    - headers:
        cookie:
          regex: "^(.*?;)?(user=dev-123)(;.*)?"

so you could try to use something like:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
 name: my-virtualservice
spec:
 hosts:
 - "*"
 gateways:
 - my-gateway
 http:
 - match:
   - uri:
       prefix:
         regex: "/applications/(?<appname>.*)"
   route:
   - destination:
       host: match_group['appname']
       port:
         number: 9080

instead of regix