manifests: Allow traffic to the API-Server if the identity header is …

…not set (kubeflow#5420)

Signed-off-by: Yannis Zarkadas <yanniszark@arrikto.com>

manifests/kustomize/base/installs/multi-user/istio-authorization-config.yaml

@@ -32,6 +32,10 @@ spec:
         - cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
         - cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
         - cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
+  # For user workloads, which cannot user http headers for authentication
+  - when:
+    - key: request.headers[kubeflow-userid]
+      notValues: ['*']
 ---
 apiVersion: security.istio.io/v1beta1
 kind: AuthorizationPolicy