Enable the classification banner

What you’ll accomplish

After completing this guide, web applications exposed through the Istio service mesh will display a security classification banner at the top (and optionally the bottom) of the page. The banner color automatically corresponds to the standard classification markings.

Prerequisites

• UDS CLI installed
• UDS Registry account created and authenticated locally with a read token
• Access to a Kubernetes cluster with UDS Core deployed

Before you begin

The classification banner is injected into HTTP responses by an Istio EnvoyFilter on the gateway. A CSS-only viewport frame places the application in a scrollable row between dedicated banner rows, including applications with fixed navigation or roots sized to the full viewport.

Because both modes modify the HTML response body, validate the banner in a staging environment before adopting it. For custom-built applications, implementing the banner natively within the application is often a more reliable approach.

Steps

1. Configure the banner text and footer

   Set the classification level via bundle overrides. The footer banner is enabled by default (addFooter: true); include it in your overrides only if you need to disable it.

   uds-bundle.yaml

   packages:
     - name: core
       repository: registry.defenseunicorns.com/public/core
       ref: x.x.x-upstream
       overrides:
         istio-controlplane:
           uds-global-istio-config:
             values:
               - path: classificationBanner.text
                 value: "UNCLASSIFIED"

   Supported classification levels:

   Value	Banner color
   UNCLASSIFIED	Green
   CUI	Purple
   CONFIDENTIAL	Blue
   SECRET	Red
   TOP SECRET	Orange
   TOP SECRET//SCI	Yellow
   UNKNOWN	Black (default)
   SAMPLE BANNER	Black (demo placeholder)

   Tip

   The text field also supports additional markings appended with // (e.g., SECRET//NOFORN). The banner color is determined by the base classification level.

2. Specify which hosts display the banner

   The banner is opt-in per host. Add each hostname to the enabledHosts array:

   uds-bundle.yaml

   packages:
     - name: core
       repository: registry.defenseunicorns.com/public/core
       ref: x.x.x-upstream
       overrides:
         istio-controlplane:
           uds-global-istio-config:
             values:
               - path: classificationBanner.text
                 value: "UNCLASSIFIED"
               - path: classificationBanner.addFooter
                 value: true
               - path: classificationBanner.enabledHosts
                 value:
                   - keycloak.{{ .Values.adminDomain }}
                   - sso.{{ .Values.domain }}
                   - grafana.{{ .Values.adminDomain }}

   Tip

   Host values support Helm templating. Use {{ .Values.adminDomain }} for hosts on the admin gateway and {{ .Values.domain }} for tenant-facing applications.

3. Create and deploy your bundle

   uds create <path-to-bundle-dir>
   uds deploy uds-bundle-<name>-<arch>-<version>.tar.zst

Verification

Open each configured host in a browser. You should see a colored banner at the top of the page displaying the classification text. If addFooter is enabled, the same banner appears at the bottom.

Confirm that the application is constrained between the banners and that its content scrolls within the middle row. Confirm that fixed navigation, dialogs, and other overlays do not cover either banner.

Troubleshooting

Problem: Banner not appearing on a host

Symptom: A configured host loads normally but no classification banner is displayed.

Solution: Verify the hostname is included in the enabledHosts array. The host must match exactly, including any subdomain prefixes. Check the deployed EnvoyFilter:

uds zarf tools kubectl get envoyfilter classification-banner -n istio-system -o yaml

Problem: Banner breaks page layout or doesn’t render correctly

Symptom: The banner HTML is injected but the page layout is disrupted or the banner is invisible.

Solution: The banner uses a CSS-only frame with dedicated banner rows and a scrollable content row. If an application still breaks because it depends on a specific body structure, implement the classification banner natively within the application instead of relying on EnvoyFilter injection.

Related documentation

• Astro UXDS Classification Markings - standard color and formatting reference
• Istio EnvoyFilter - how Istio modifies HTTP responses at the gateway
• Networking concepts - Understand how UDS Core manages the Istio service mesh and gateways.