# A namespace runs in Istio ambient mode. You need HTTP header-based routing and L7 authorization for one of its services. What do you add?

Istio, Hard (Expert), Architecture. https://k8wiz.com/uquiz/a-namespace-runs-in-istio-ambient-mode-you-need-http-header-based-routing-and-l7-authorization-for-one-of-its-services-what-do-y

- A. A sidecar.istio.io/inject annotation on the service
- B. An EnvoyFilter on ztunnel
- C. A waypoint proxy, with the namespace or service labeled to use it
- D. Nothing, because ztunnel handles L7 routing

**Answer:** A waypoint proxy, with the namespace or service labeled to use it

**Explanation:** ztunnel only works at L4. For HTTP routing, retries, fault injection or L7 AuthorizationPolicy, you deploy a waypoint, an Envoy-based proxy you can create with 'istioctl waypoint apply'. Then you label the namespace or service with istio.io/use-waypoint so its traffic goes through it.