prysm-pulse/k8s/x_headers_rule.yaml

apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: x-headers
  namespace: istio-system
spec:
  match: destination.name != "unknown"
  responseHeaderOperations:
    - name: x-backend
      values: [ destination.name ]
      operation: APPEND
    - name: x-source
      values: [ source.workload.name ]
      operation: APPEND
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: x-headers-public
  namespace: istio-system
spec:
  match: source.workload.name == "istio-ingressgateway"
  responseHeaderOperations:
    - name: x-backend
      operation: REMOVE
    - name: x-source
      operation: REMOVE
    - name: x-envoy-upstream-service-time
      operation: REMOVE
    - name: server
      operation: REMOVE
    - name: grpc-metadata-x-backend
      operation: REMOVE
    - name: grpc-metadata-x-source
      operation: REMOVE
    - name: grpc-metadata-x-envoy-upstream-service-time
      operation: REMOVE
    - name: grpc-metadata-server
      operation: REMOVE