This version of the istio control plane includes a bundled EnvoyFilter that
makes it simple to add classification banners to any of your workloads:
How to enable
The EnvoyFilter is deployed in the istio-system namespace so it's available
cluster-wide. To enable the banner on a particular workload, it's as simple as
adding the following label to the pod's metadata:
classification-banner.bigbang.dev/inject: "true"
This will add a classification banner at the default unclassified level.
Customization
The banner can be further configured with annotations on the workload:
If none of the built-in classification levels meet your needs,
you can customize the classification text, text color, and background:
classification-banner.bigbang.dev/text: SUPER DUPER TOP SECRETclassification-banner.bigbang.dev/text-color: whiteclassification-banner.bigbang.dev/background: black
Custom HTML
If the default classification banner injection does not work correctly
with your workload, you can also inject your own custom HTML tailored
to the application:
