Azure / Azure/AKS

[Feature] [Service Mesh / ASM] Support enabling experimental feature flags (e.g., PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS) in ASM 1.30+

Open
#5,893 1 comment 0 reactions 1 assignee Claimed by @therealmitchconnors View on GitHub
feature-request service-mesh
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
4d 15h
Merged PRs (30d)
14

Description

**Is your feature request related to a problem? Please describe.**
We are utilizing the AKS-managed Istio service mesh add-on (asm-1-30). Our application architecture requires binding multiple custom external authorization providers to individual workloads or routes.

In upstream Istio, this capability is governed by the experimental environment variable PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS.

Because this is managed infrastructure, we face two key roadblocks:

Manually modifying the managed istiod deployment to inject experimental environment flags results in the reconciler reverting the changes.

The exposed configuration schema via the managed custom resource (IstioConfiguration) does not currently expose a mechanism to toggle experimental environment flags or enable multi-provider custom authorization features.

**Describe the solution you'd like**
We would like one of the following solutions provided natively within the AKS managed Istio add-on:

Configurable Environment Flags: Support a controlled way via the managed configuration (IstioConfiguration or equivalent CR) to inject specific safe/experimental Istio pilot environment variables like PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS.

First-class Support: Officially support multiple custom authorization providers natively within the managed asm-1-30 release tier.

**Describe alternatives you've considered**
Direct Deployment Patching: Attempted patching deployment/istiod, but the operator's reconciliation loop continuously reverts manual changes.

Falling back to Self-Managed Istio: We are evaluating whether we must abandon the managed add-on and deploy a self-managed upstream Istio instance just to toggle this specific control-plane flag, which defeats the operational benefits of the Azure-managed service.

**Additional context**
Add-on Version: asm-1-30

Upstream Feature Reference: Istio PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS feature flag.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.