[Feature] [Service Mesh / ASM] Support enabling experimental feature flags (e.g., PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS) in ASM 1.30+
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 14
Description
**Is your feature request related to a problem? Please describe.**
We are utilizing the AKS-managed Istio service mesh add-on (asm-1-30). Our application architecture requires binding multiple custom external authorization providers to individual workloads or routes.
In upstream Istio, this capability is governed by the experimental environment variable PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS.
Because this is managed infrastructure, we face two key roadblocks:
Manually modifying the managed istiod deployment to inject experimental environment flags results in the reconciler reverting the changes.
The exposed configuration schema via the managed custom resource (IstioConfiguration) does not currently expose a mechanism to toggle experimental environment flags or enable multi-provider custom authorization features.
**Describe the solution you'd like**
We would like one of the following solutions provided natively within the AKS managed Istio add-on:
Configurable Environment Flags: Support a controlled way via the managed configuration (IstioConfiguration or equivalent CR) to inject specific safe/experimental Istio pilot environment variables like PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS.
First-class Support: Officially support multiple custom authorization providers natively within the managed asm-1-30 release tier.
**Describe alternatives you've considered**
Direct Deployment Patching: Attempted patching deployment/istiod, but the operator's reconciliation loop continuously reverts manual changes.
Falling back to Self-Managed Istio: We are evaluating whether we must abandon the managed add-on and deploy a self-managed upstream Istio instance just to toggle this specific control-plane flag, which defeats the operational benefits of the Azure-managed service.
**Additional context**
Add-on Version: asm-1-30
Upstream Feature Reference: Istio PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS feature flag.
Contributor guide
Assessment
This issue has not been assessed yet.