# After enabling ENABLE_GATEWAY_API_HTTPROUTE_AUTH on istiod, an EnvoyFilter that patches the gateway filter envoy.filters.http.rbac no longer affects ALLOW policies. Why?

Istio, Medium (Advanced), Advanced Configuration. https://k8wiz.com/uquiz/after-enabling-enable_gateway_api_httproute_auth-on-istiod-an-envoyfilter-that-patches-the-gateway-filter-envoyfiltershttprbac-n

- A. The flag moves all authorization checks into the ext_authz filter
- B. The ALLOW filter on the gateway is now named istio.authorization.allow
- C. EnvoyFilter resources are ignored on gateways that use HTTPRoute
- D. The ALLOW filter is now emitted as a route-level filter only

**Answer:** The ALLOW filter on the gateway is now named istio.authorization.allow

**Explanation:** With the flag on, Istio 1.32 emits the ALLOW action's HTTP filter on ingress gateways as istio.authorization.allow, while DENY and AUDIT keep envoy.filters.http.rbac. Patches matching the old name silently stop applying to ALLOW. Add a second EnvoyFilter that matches the new name, or leave the flag off.