--- title: Charmhub | Deploy Istio using Charmhub - The Open Operator Collection description: Deploy the latest version of Istio as a Kubernetes Operator on any cloud. url: https://charmhub.io/istio-k8s/libraries/istio_ingress_config --- # Istio [Canonical Observability](https://charmhub.io/publisher/observability "View all packages from Canonical Observability") * [Canonical Observability](https://charmhub.io/publisher/observability "View all packages from Canonical Observability") Platform: 1.31/candidate 82 ``` juju deploy istio-k8s --channel 1.31/candidate ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) [Toggle side navigation](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#drawer) ## charms.istio\_k8s.v0.istio\_ingress\_config * [*Docstrings*Docstrings](https://charmhub.io/istio-k8s/libraries/istio_ingress_config) [*Code*Source code](https://charmhub.io/istio-k8s/libraries/istio_ingress_config/source-code) * + Download Fetch library ``` charmcraft fetch-lib charms.istio_k8s.v0.istio_ingress_config ``` [Download istio\_ingress\_config.py](https://charmhub.io/istio-k8s/libraries/istio_ingress_config/download) + *Last updated* 05 May 2026 + *Revision* Library version 0.4 istio\_ingress\_config. This library implements endpoint wrappers for the istio-ingress-config interface. Currently, it facilitates the exchange of external authorizer configuration details such as the service name, port and a provider identifier. Usage: Requirer (istio k8s charm): ``` class FooCharm(CharmBase): def __init__(self, framework): super().__init__(framework) self.ingress_config = IngressConfigRequirer(self.model.relations, self.app, "istio-ingress-config") self.framework.observe(self.on["istio-ingress-config"].relation_changed, self._on_ingress_config_changed) self.framework.observe(self.on["istio-ingress-config"].relation_broken, self._on_ingress_config_changed) def _on_ingress_config_changed(self, event): # Publish a unique ext_authz_provider_name for each connected ingress provider. for relation in self.ingress_config.relations: if self.ingress_config.is_provider_ready(relation): ext_authz_info = self.ingress_config.get_provider_ext_authz_info(relation) unique_name = generate_provider_name(relation.app.name, ext_authz_info) # type: ignore self.ingress_config.publish_ext_authz_provider_name(relation, unique_name) def generate_provider_name( ingress_app_name: str, ext_authz_info: ProviderIngressConfigData ) -> str: data = f"{ext_authz_info.ext_authz_service_name}:{ext_authz_info.ext_authz_port}" stable_hash = hashlib.sha256(data.encode("utf-8")).hexdigest() return f"ext_authz-{ingress_app_name}-{stable_hash}" ... ``` Provider (istio ingress charm): ``` class FooCharm(CharmBase): def __init__(self, framework): super().__init__(framework) self.ingress_config = IngressConfigProvider(self.model.relations, self.app, "istio-ingress-config") self.framework.observe(self.on.leader_elected, self.publish_config) self.framework.observe(self.on["istio-ingress-config"].relation_joined, self.publish_config) self.framework.observe(self.on.some_event, self.publish_config) def publish_config(self, event): # Publish the ext_authz service details to our databag. self.ingress_config.publish(ext_authz_service_name="my-ext_authz-service", ext_authz_port="8080") # Later, fetch the ext_authz provider name generated by the requirer: if self.ingress_config.is_requirer_ready(): provider_name = self.ingress_config.get_ext_authz_provider_name() # Do something with provider_name ... ``` --- Index * [class ProviderIngressConfigData](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#provideringressconfigdata) * + [def validate\_ext\_authz\_port( cls, port)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#provideringressconfigdata-validate_ext_authz_port) * [class RequirerIngressConfigData](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#requireringressconfigdata) * [class IngressConfigProvider](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider) * + [def \_\_init\_\_( self, relation\_mapping, app, relation\_name)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider-__init__) * + [def relations( self)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider-relations) * + [def publish( self, ext\_authz\_service\_name, ext\_authz\_port, include\_headers\_in\_check, headers\_to\_upstream\_on\_allow, headers\_to\_downstream\_on\_allow, headers\_to\_downstream\_on\_deny)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider-publish) * + [def clear( self)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider-clear) * + [def get\_ext\_authz\_provider\_name( self)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider-get_ext_authz_provider_name) * + [def is\_ready( self)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigprovider-is_ready) * [class IngressConfigRequirer](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer) * + [def \_\_init\_\_( self, relation\_mapping, app, relation\_name)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-__init__) * + [def relations( self)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-relations) * + [def publish\_ext\_authz\_provider\_name( self, relation, unique\_name)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-publish_ext_authz_provider_name) * + [def get\_provider\_ext\_authz\_info( self, relation)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-get_provider_ext_authz_info) * + [def is\_fake\_authz\_config( self, relation)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-is_fake_authz_config) * + [def is\_ready( self, relation)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-is_ready) * + [def get\_ext\_authz\_provider\_name( self, relation)](https://charmhub.io/istio-k8s/libraries/istio_ingress_config#ingressconfigrequirer-get_ext_authz_provider_name) #### class ProviderIngressConfigData Data model for the provider side of the relation. Description Holds the external authorizer service name, port, and header configuration. Methods ProviderIngressConfigData. validate\_ext\_authz\_port( cls , port ) Description Ensure port is convertible to int. None #### class RequirerIngressConfigData Data model for the requirer side of the relation. Description Holds the generated external authorizer provider name and the ingress charm's application name. #### class IngressConfigProvider Provider side wrapper for the istio-ingress-config relation. Description The provider (ingress charm) publishes its external authorizer service name and port and can fetch the generated external authorizer provider name from the requirer's databag. Methods IngressConfigProvider. \_\_init\_\_( *self* , relation\_mapping: RelationMapping , app: Application , relation\_name: str ) Initialize the IngressConfigProvider. Arguments relation\_mapping The charm's RelationMapping (typically self.model.relations). app This application (the ingress charm). model\_name This application juju model (the ingress charm). relation\_name The name of the relation. IngressConfigProvider. relations( *self* ) Description Return the relation instances for the monitored relation. None IngressConfigProvider. publish( *self* , ext\_authz\_service\_name , ext\_authz\_port , include\_headers\_in\_check , headers\_to\_upstream\_on\_allow , headers\_to\_downstream\_on\_allow , headers\_to\_downstream\_on\_deny ) Publish external authorizer configuration data to all related applications. Arguments ext\_authz\_service\_name The external authorizer service name. ext\_authz\_port The port number for the external authorizer service. include\_headers\_in\_check Headers to forward to the external authorizer for checking. headers\_to\_upstream\_on\_allow Headers to pass to upstream on successful auth. headers\_to\_downstream\_on\_allow Headers to send to client on successful auth. headers\_to\_downstream\_on\_deny Headers to send to client on denied auth. IngressConfigProvider. clear( *self* ) Description Clear the local application databag. None IngressConfigProvider. get\_ext\_authz\_provider\_name( *self* ) Fetch the external authorizer provider name generated by the requirer for this provider. Returns The generated external authorizer provider name if available, else None. IngressConfigProvider. is\_ready( *self* ) Guard to check if the generated external authorizer provider name is present. Returns True if the external authorizer provider name has been published by the requirer. #### class IngressConfigRequirer Requirer side wrapper for the istio-ingress-config relation. Description The requirer generates and publishes a unique external authorizer provider name for a connected ingress charm. It can also check that the provider has published its required external authorizer service configuration. Methods IngressConfigRequirer. \_\_init\_\_( *self* , relation\_mapping: RelationMapping , app: Application , relation\_name: str ) Initialize the IngressConfigRequirer. Arguments relation\_mapping The charm's RelationMapping (typically self.model.relations). app This application. relation\_name The name of the relation. IngressConfigRequirer. relations( *self* ) Description Return the relation instances for the monitored relation. None IngressConfigRequirer. publish\_ext\_authz\_provider\_name( *self* , relation: Relation , unique\_name: str ) Publish a unique external authorizer provider name and ingress provider name for a connected ingress charm. Arguments relation A specific relation instance. unique\_name The unique external authorizer provider name to publish. Description The provided unique\_name is stored as the ext\_authz\_provider\_name, and the ingress charm's application name is stored as ingress\_provider\_name. IngressConfigRequirer. get\_provider\_ext\_authz\_info( *self* , relation: Relation ) Retrieve the entire provider app databag for the given relation. Arguments relation A specific relation instance. Returns An instance of ProviderIngressConfigData if available and valid, else None. Description This method retrieves the data that the provider (ingress charm) has published, validates it using the ProviderIngressConfigData model, and returns the model instance. IngressConfigRequirer. is\_fake\_authz\_config( *self* , relation: Relation ) Check if the provider has published a fake external authorization configuration. Returns True if any of the provider relations contains fake authz configuration, else False. IngressConfigRequirer. is\_ready( *self* , relation: Relation ) Guard to check if the provider has published its external authorizer service configuration. Arguments relation A specific relation instance. Returns True if both ext\_authz\_service\_name and ext\_authz\_port are present in the provider's databag. IngressConfigRequirer. get\_ext\_authz\_provider\_name( *self* , relation: Relation ) Retrieve the generated external authorizer provider name for the given provider. Arguments relation A specific relation instance. Returns The external authorizer provider name if available, else None.