title: Istio Service Mesh Security with AuthorizationPolicy & RequestAuthentication
body: <p>The authentication using kyecloak isn't working as expected, it been used Istio vs Keycloak.
  Istio components configured :  Gateway, Virtualservice, AuthorizationPolicy, RequestAuthentication</p>
  <p>using a valid token: <strong>401 Jwt issuer is not configured</strong></p>
  <p><a href="https://i.stack.imgur.com/zYMaM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zYMaM.png" alt="enter image description here" /></a></p>
  <p>ISTIO CONFIGURATION FOR SECURITY:</p>
  <pre><code>---  
   kubectl apply -f - &lt;&lt;EOF
  apiVersion: security.istio.io/v1beta1
  kind: RequestAuthentication
  metadata:
    name: &quot;jwt-example&quot;
    namespace: istio-system
  spec:
    selector:
      matchLabels:
        istio: ingressgateway
    jwtRules:
    - issuer: &quot;http://localhost:30080/auth/realms/master&quot;
      jwksUri: &quot;http://localhost:30080/auth/realms/master/protocol/openid-connect/certs&quot;
      forwardOriginalToken: true
      outputPayloadToHeader: x-jwt-payload
      EOF
  ---
   kubectl apply -f - &lt;&lt;EOF
  apiVersion: &quot;security.istio.io/v1beta1&quot;
  kind: &quot;AuthorizationPolicy&quot;
  metadata:
    name: &quot;frontend-ingress&quot;
    namespace: istio-system
  spec:
    selector:
      matchLabels:
        istio: ingressgateway
    action: DENY
    rules:
    - from:
      - source:
          notRequestPrincipals: [&quot;*&quot;]
    principalBinding: USE_ORIGIN
      EOF
  --- 
  </code></pre>
  <p>once there is no authorization Bearer</p>
  <p><a href="https://i.stack.imgur.com/sWgyM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sWgyM.png" alt="enter image description here" /></a></p>
  <p>for double check i used istio's example and worked :</p>
  <pre><code> kubectl apply -f - &lt;&lt;EOF
  apiVersion: &quot;security.istio.io/v1beta1&quot;
  kind: &quot;RequestAuthentication&quot;
  metadata:
    name: &quot;jwt-example&quot;
    namespace: istio-system
  spec:
    selector:
      matchLabels:
        istio: ingressgateway
    jwtRules:
    - issuer: &quot;testing@secure.istio.io&quot;
      jwksUri: &quot;https://raw.githubusercontent.com/istio/istio/release-1.8/security/tools/jwt/samples/jwks.json&quot;
  EOF
  kubectl apply -f - &lt;&lt;EOF
  apiVersion: &quot;security.istio.io/v1beta1&quot;
  kind: &quot;AuthorizationPolicy&quot;
  metadata:
    name: &quot;frontend-ingress&quot;
    namespace: istio-system
  spec:
    selector:
      matchLabels:
        istio: ingressgateway
    action: DENY
    rules:
    - from:
      - source:
          notRequestPrincipals: [&quot;*&quot;]
  EOF
  </code></pre>
  <p>ISTIO GTW and VS :</p>
  <pre><code>apiVersion: networking.istio.io/v1alpha3    
  kind: Gateway                               
  metadata:                                   
    name: keycloak-gateway
    namespace: default
  spec:                                       
    selector:                                 
      istio: ingressgateway                   
    servers:                                  
    - hosts:                                  
      - '*'                                   
      port:                                   
        name: http                            
        number: 80                            
        protocol: HTTP
  
  ---
  apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: enterprise-vs
  spec:
    hosts:
      - '*'
    gateways:
      - default/keycloak-gateway
    http:
      - match:
          - uri:
              prefix: '/enterprise/'
        rewrite:
          uri: /
        fault:
          delay:
            fixedDelay: 1s
        route:
          - destination:
              host: enterprise
              port:
                number: 8080
              subset: enterprise-s1
            weight: 90
          - destination:
              host: enterprise
              port:
                number: 8080
              subset: enterprise-s2
            weight: 10
  </code></pre>