Istio
Medium
Advanced Configuration
After enabling ENABLE_GATEWAY_API_HTTPROUTE_AUTH on istiod, an EnvoyFilter that patches the gateway filter envoy.filters.http.rbac no longer affects ALLOW policies. Why?
Select your answer:
Show answer and explanation
Answer: The ALLOW filter on the gateway is now named istio.authorization.allow
Explanation
With the flag on, Istio 1.32 emits the ALLOW action's HTTP filter on ingress gateways as istio.authorization.allow, while DENY and AUDIT keep envoy.filters.http.rbac. Patches matching the old name silently stop applying to ALLOW. Add a second EnvoyFilter that matches the new name, or leave the flag off.
More medium Istio questions
- What is the purpose of Istio's AuthorizationPolicy resource?
- Which of the following is NOT a traffic management feature of Istio?
- What is a 'subset' in Istio's DestinationRule?
- How does Istio implement mutual TLS (mTLS) between services?
- What is the purpose of Istio's PeerAuthentication resource?
- Which component of Istio is responsible for certificate generation and distribution?