Skip to content
Docs
Kubernetes

Kubernetes

HmacManager runs in a cluster as an Envoy ext-authz HTTP server. Istio calls it before forwarding a request, so the check happens outside your application and needs no change to it.

ClientIstio gatewayor ambient waypointYour serviceext-authz checkhmac-managerverifies the signature200 — forwarded upstream, unchanged403 — rejected before it reaches your service

Three pieces are deployed together by one chart: the verifier that answers ext-authz checks, the operator that turns HmacPolicy resources into the config the verifier mounts, and Redis for replay protection.

The ext-authz service What the verifier does, its ports, environment and image. The Helm chart Installing, declaring policies, and running several of them. The HmacPolicy CRD Declaring policies as Kubernetes resources, and how the operator reconciles them. Enforcement Registering the provider, then choosing ingress gateway or ambient waypoint. Redis Why the chart bundles Redis, and the replica constraint when it does not.