<p><strong>Background:</strong></p>

<p>There was a similar question: <a href="https://stackoverflow.com/questions/54140994/istio-origin-authentication-using-jwt-does-not-work">Here</a> but it didn't offer a solution to my issue.</p>

<p>I have deployed an application which is working as expected to my Istio Cluster.  I wanted to enable JWT authentication, so adapting the instructions <a href="https://istio.io/docs/tasks/security/authn-policy/#end-user-authentication" rel="nofollow noreferrer">Here</a> to my use-case.  </p>

<p><strong>ingressgateway:</strong></p>

<p>I first applied the following policy to the istio-ingressgateway.  This worked and any traffic sent without a JWT token was blocked.</p>

<pre><code>kubectl apply -n istio-system -f mypolicy.yaml
</code></pre>

<pre><code>apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: core-api-policy
  namespace: istio-system
spec:
  targets:
  - name: istio-ingressgateway
    ports:
    - number: 80
  origins:
  - jwt:
      issuer: "https://cognito-idp.ap-northeast-1.amazonaws.com/ap-northeast-1_pa9vj7sbL"
      jwksUri: "https://cognito-idp.ap-northeast-1.amazonaws.com/ap-northeast-1_pa9vj7sbL/.well-known/jwks.json"
  principalBinding: USE_ORIGIN

</code></pre>

<p>Once that worked I deleted this policy and installed a new policy for my service.</p>

<pre><code>kubectl delete -n istio-system -f mypolicy.yaml
</code></pre>

<p><strong>service/core-api-service:</strong></p>

<p>After editing the above policy, changing the namespace and target as below, I reapplied the policy to the correct namespace.</p>

<p>Policy:</p>

<pre><code>kubectl apply -n solarmori -f mypolicy.yaml
</code></pre>

<pre><code>apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: core-api-policy
  namespace: solarmori
spec:
  targets:
  - name: core-api-service
    ports:
    - number: 80
  origins:
  - jwt:
      issuer: "https://cognito-idp.ap-northeast-1.amazonaws.com/ap-northeast-1_pa9vj7sbL"
      jwksUri: "https://cognito-idp.ap-northeast-1.amazonaws.com/ap-northeast-1_pa9vj7sbL/.well-known/jwks.json"
  principalBinding: USE_ORIGIN
</code></pre>

<p>Service:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: core-api-service
spec:
  type: LoadBalancer
  ports:
  - port: 80
    name: api-svc-port
    targetPort: api-app-port
  selector:
    app: core-api-app
</code></pre>

<p>The outcome of this action didn't appear to change anything in processing of traffic. I was still able to reach my service even though I did not provide a JWT.</p>

<p>I checked the istio-proxy of my service deployment and there was no creation of a <code>local_jwks</code> in the logs as described <a href="https://istio.io/help/ops/security/end-user-auth/" rel="nofollow noreferrer">Here</a>.</p>

<pre><code>[procyclinsur@P-428 istio]$ kubectl logs -n solarmori core-api-app-5dd9666777-qhf5v -c istio-proxy | grep local_jwks
[procyclinsur@P-428 istio]$
</code></pre>

<p>If anyone knows where I am going wrong I would greatly appreciate any help.</p>

<p>For a Service to be part of Istio's service mesh you need to fulfill some requirements as shown in the official <a href="https://istio.io/docs/setup/kubernetes/spec-requirements/" rel="nofollow noreferrer">docs</a>.</p>

<p>In your case, the service port name needs to be updated to:
 <code>&lt;protocol&gt;[-&lt;suffix&gt;]</code> with the <code>&lt;protocol&gt;</code> as either: </p>

<ul>
<li>grpc</li>
<li>http</li>
<li>http2</li>
<li>https</li>
<li>mongo</li>
<li>mysql</li>
<li>redis</li>
<li>tcp</li>
<li>tls</li>
<li>udp</li>
</ul>

<p>At that point requests forwarded to the service will go through the service mesh; Currently, requests are resolved by Kubernetes networking.</p>
