<p>I need to exclude specific host from the EnvoyFilter that looks like this:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: authn-filter
spec:
  workloadLabels:
    istio: ingressgateway
  filters:
  - filterConfig:
      httpService:
        serverUri:
          uri: http://authservice.$(namespace).svc.cluster.local
          cluster: outbound|8080||authservice.$(namespace).svc.cluster.local
          failureModeAllow: false
          timeout: 10s
        authorizationRequest:
          allowedHeaders:
            patterns:
            - exact: "cookie"
            - exact: "X-Auth-Token"
        authorizationResponse:
          allowedUpstreamHeaders:
            patterns:
            - exact: "kubeflow-userid"
      statusOnError:
        code: GatewayTimeout
    filterName: envoy.ext_authz
    filterType: HTTP
    insertPosition:
      index: FIRST
    listenerMatch:
      listenerType: GATEWAY
</code></pre>

<p>The problem is that the filter applies to the default istio ingress gateway which affects all traffic that is coming through that gateway, i would like to have some hosts that could be excluded / whitelisted from the filter.</p>

Alex Pryiomka
<p>I found my answer <a href="https://stackoverflow.com/questions/63448933/istio-exclude-service-from-ext-auth">here</a>. The question asks to exclude some paths, but I was successful with hosts as well. This is what I used:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: bypass-authn
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      routeConfiguration:
        vhost:
          name: subdomain.example.org:80 # &lt;== your host goes here
    patch:
      operation: MERGE
      value:
        name: envoy.ext_authz_disabled
        typed_per_filter_config:
          envoy.ext_authz:
            &quot;@type&quot;: type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
            disabled: true
</code></pre>
<p>More information in <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/#EnvoyFilter-RouteConfigurationMatch-VirtualHostMatch" rel="nofollow noreferrer">Istio documentation</a>. Specifically, the documentation specifies that you should also put into the <code>name:</code> field the port, but I think it should work without it as well.</p>
