Great article thanks , but maybe you can use "spiffe id" to identify your workloads instead of the Authorization header because Istio natively support SPIFFE spec via its own component called Citadel.