AKS Managed Istio (asm-1-30): Can experimental feature flags like PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS be enabled?

Kamil Grebenicek 60 Reputation points
2026-08-04T14:03:52.23+00:00

Hello,

We are utilizing the AKS managed Istio service mesh add-on (asm-1-30). Our architecture requires binding multiple custom external authorization providers to individual workloads, a capability governed upstream in Istio by the experimental environment variable PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS.

When attempting to manually inject this environment variable into the managed istiod deployment, the reconciliation loop naturally reverts the change.

Could the product team clarify:

Is there any supported mechanism or configuration override in the AKS Istio add-on to enable experimental/flag-gated control plane features like PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS?

If not, what is the roadmap or official recommendation for multi-provider custom authorization workloads when using the managed add-on versus falling back to a self-managed upstream Istio installation?

Thank you!

Azure Kubernetes Service
Azure Kubernetes Service

An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.

0 comments
Answer accepted by question author
SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator
2026-08-04T14:58:02.48+00:00

Hello @Kamil Grebenicek,

Thank You for using Q & A forum.

Supported Mechanisms for Customization in AKS Managed Istio

Limited Customization:

The AKS managed Istio add-on provides a set of configurations that you can adjust through the IstioConfiguration custom resource. However, this does not typically include experimental feature flags like PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS.

Environment Variables:

As you’ve noticed, manually injecting environment variables into the managed istiod deployment is not supported because the reconciliation loop will revert any manual changes. This is a common behavior in managed services to ensure stability and consistency.

Official Recommendations

Using AKS Managed Istio

If you need to use experimental features or require deep customizations:

Feedback and Feature Requests: Provide feedback to the Azure team regarding the feature you need. The AKS product team regularly evaluates community feedback to prioritize features in future releases.

Wait for Official Support: Keep an eye on the AKS and Istio release notes for any announcements regarding the support of experimental features.

Falling Back to Self-Managed Istio

If immediate access to experimental features is critical:

Self-Managed Istio: Deploy Istio in a self-managed manner within your AKS cluster. This approach allows you to freely configure environment variables, including experimental flags, and make other deep customizations.

Installation: Follow the official Istio installation documentation to set up Istio in your AKS cluster.

Configuration: Inject the PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS environment variable into the istiod deployment as per Istio’s documentation on setting environment variables.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anusree Nashetty 6,715 Reputation points Microsoft External Staff Moderator
    2026-08-07T08:25:22.25+00:00

    Hello Kamil Grebenicek,

    Thank you for the detailed question.

    In addition to the information already provided by the SUNOJ KUMAR YELURU, it is important to note that the AKS Istio add-on is a managed service, and the Istio control plane components (including istiod) are continuously reconciled by Azure. As a result, direct modifications to managed resources, such as adding custom environment variables to the istiod Deployment, are not a supported customization mechanism and will be reverted by the reconciliation process.

    Currently, the supported customization model for the AKS Istio add-on is through documented configuration surfaces such as MeshConfig and the IstioConfiguration custom resource. Azure explicitly categorizes MeshConfig settings as supported, allowed, or blocked, and control-plane feature flags are not generally exposed through these configuration interfaces.

    Regarding the specific upstream Istio feature flag: PILOT_ENABLE_MULTIPLE_CUSTOM_AUTHZ_PROVIDERS this is an upstream Istio experimental/control-plane feature gate, and, at this time, there is no documented AKS Istio add-on configuration that allows customers to enable arbitrary Pilot environment flags or override the managed istiod configuration. Based on the publicly available AKS documentation, such customizations are not currently supported in the managed add-on.

    Therefore, if your architecture has a hard dependency on multiple custom external authorization providers and requires enabling this experimental flag, the current recommendation would be to evaluate a self-managed Istio deployment on AKS, where you have full control over the control plane configuration, feature gates, and upgrade lifecycle. This approach comes with additional operational responsibility but provides access to upstream Istio capabilities that may not yet be exposed through the managed add-on.

    For your references:

    https://learn.microsoft.com/en-us/azure/aks/istio-meshconfig

    https://learn.microsoft.com/en-us/azure/aks/istio-support-policy

    https://learn.microsoft.com/en-us/azure/aks/istio-about

    If you have any further queries, please do let us know. If the answer is helpful, please click "Accept Answer" and "Upvote it"

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.