Pilot and Mixer components can perform server-side validation of configuration through k8s webhooks. This code has already be implemented but has not yet been enabled by default due to cloud provider bug.

TODO

• Update Istio install script to generate and install certs for Pilot and Mixer webhook validation services.
• Update Pilot e2e test to use validation webhook by default on k8s >= 1.9
• Update Pilot validation webhook to upgrade to latest install recipe
• Update Mixer e2e test to use validation webhook by default on k8s >= 1.9
• Update Mixer validation webhook to upgrade to latest install recipe
• Documentation on istio.io under kubernetes specific setups, and config concepts.

After this is done, the feature is always on. We can consider it to be beta.